diff --git a/.gitignore b/.gitignore
index b88925ba01ed..ec6b5ec8902e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,8 @@ ExcludedTenants
 SendNotifications/config.json
 .env
 Output/
+node_modules/.yarn-integrity
+yarn.lock
 
 # Cursor IDE
 .cursor/rules
diff --git a/CIPPTimers.json b/CIPPTimers.json
index 0005053fd75c..f76dba8941e2 100644
--- a/CIPPTimers.json
+++ b/CIPPTimers.json
@@ -222,5 +222,23 @@
     "Priority": 21,
     "RunOnProcessor": true,
     "IsSystem": true
+  },
+  {
+    "Id": "9a7f8e6d-5c4b-3a2d-1e0f-9b8c7d6e5f4a",
+    "Command": "Start-CIPPDBCacheOrchestrator",
+    "Description": "Timer to collect and cache Microsoft Graph data for all tenants",
+    "Cron": "0 0 3 * * *",
+    "Priority": 22,
+    "RunOnProcessor": true,
+    "IsSystem": true
+  },
+  {
+    "Id": "1f2e3d4c-5b6a-7c8d-9e0f-1a2b3c4d5e6f",
+    "Command": "Start-TestsOrchestrator",
+    "Description": "Timer to run security and compliance tests against cached data",
+    "Cron": "0 0 4 * * *",
+    "Priority": 23,
+    "RunOnProcessor": true,
+    "IsSystem": true
   }
 ]
diff --git a/ExampleReportTemplate.ps1 b/ExampleReportTemplate.ps1
new file mode 100644
index 000000000000..e1973a4ba742
--- /dev/null
+++ b/ExampleReportTemplate.ps1
@@ -0,0 +1,19 @@
+$Table = Get-CippTable -tablename 'CippReportTemplates'
+
+# Dynamically discover all ZTNA test files
+$TestFiles = Get-ChildItem "C:\Github\CIPP-API\Modules\CIPPCore\Public\Tests\Invoke-CippTestZTNA*.ps1" | Sort-Object Name
+$AllTestIds = $TestFiles.BaseName | ForEach-Object { $_ -replace 'Invoke-CippTestZTNA', 'ZTNA' }
+
+Write-Host "Discovered $($AllTestIds.Count) ZTNA tests"
+
+$Entity = @{
+    RowKey        = 'd5d1e123-bce0-482d-971f-be6ed820dd92'
+    PartitionKey  = 'ReportingTemplate'
+    IdentityTests = [string]($AllTestIds | ConvertTo-Json -Compress)
+    Description   = 'Complete Zero Trust Network Assessment Report'
+    Name          = 'Full ZTNA Report'
+}
+
+Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
+
+Write-Host "Report template created successfully with ID: $($Entity.RowKey)"
diff --git a/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 b/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1
new file mode 100644
index 000000000000..88b630bdf701
--- /dev/null
+++ b/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1
@@ -0,0 +1,91 @@
+function Add-CIPPDbItem {
+    <#
+    .SYNOPSIS
+        Add items to the CIPP Reporting database
+
+    .DESCRIPTION
+        Adds items to the CippReportingDB table with support for bulk inserts and count mode
+
+    .PARAMETER TenantFilter
+        The tenant domain or GUID (used as partition key)
+
+    .PARAMETER Type
+        The type of data being stored (used in row key)
+
+    .PARAMETER Data
+        Array of items to add to the database
+
+    .PARAMETER Count
+        If specified, stores a single row with count of each object property as separate properties
+
+    .EXAMPLE
+        Add-CIPPDbItem -TenantFilter 'contoso.onmicrosoft.com' -Type 'Groups' -Data $GroupsData
+
+    .EXAMPLE
+        Add-CIPPDbItem -TenantFilter 'contoso.onmicrosoft.com' -Type 'Groups' -Data $GroupsData -Count
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $true)]
+        [string]$Type,
+
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [array]$Data,
+
+        [Parameter(Mandatory = $false)]
+        [switch]$Count
+    )
+
+    try {
+        $Table = Get-CippTable -tablename 'CippReportingDB'
+
+        # Helper function to format RowKey values by removing disallowed characters
+        function Format-RowKey {
+            param([string]$RowKey)
+
+            # Remove disallowed characters: / \ # ? and control characters (U+0000 to U+001F and U+007F to U+009F)
+            $sanitized = $RowKey -replace '[/\\#?]', '_' -replace '[\u0000-\u001F\u007F-\u009F]', ''
+
+            return $sanitized
+        }
+
+        if ($Count) {
+            $Entity = @{
+                PartitionKey = $TenantFilter
+                RowKey       = Format-RowKey "$Type-Count"
+                DataCount    = [int]$Data.Count
+            }
+
+            Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force | Out-Null
+
+        } else {
+            #Get the existing type entries and nuke them. This ensures we don't have stale data.
+            $Filter = "PartitionKey eq '{0}' and RowKey ge '{1}-' and RowKey lt '{1}0'" -f $TenantFilter, $Type
+            $ExistingEntities = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+            if ($ExistingEntities) {
+                Remove-AzDataTableEntity @Table -Entity $ExistingEntities -Force | Out-Null
+            }
+            $Entities = foreach ($Item in $Data) {
+                $ItemId = $Item.id ?? $Item.ExternalDirectoryObjectId ?? $Item.Identity ?? $Item.skuId
+                @{
+                    PartitionKey = $TenantFilter
+                    RowKey       = Format-RowKey "$Type-$ItemId"
+                    Data         = [string]($Item | ConvertTo-Json -Depth 10 -Compress)
+                    Type         = $Type
+                }
+            }
+            Add-CIPPAzDataTableEntity @Table -Entity $Entities -Force | Out-Null
+
+        }
+
+        Write-LogMessage -API 'CIPPDbItem' -tenant $TenantFilter -message "Added $($Data.Count) items of type $Type$(if ($Count) { ' (count mode)' })" -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDbItem' -tenant $TenantFilter -message "Failed to add items of type $Type : $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1 b/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1
index fc6f62033e82..0981e4b361d3 100644
--- a/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1
+++ b/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1
@@ -46,8 +46,14 @@ function Add-CIPPScheduledTask {
                 return "Could not run task: $ErrorMessage"
             }
         } else {
+            if (!$Task.RowKey) {
+                $RowKey = (New-Guid).Guid
+            } else {
+                $RowKey = $Task.RowKey
+            }
+
             if ($DisallowDuplicateName) {
-                $Filter = "PartitionKey eq 'ScheduledTask' and Name eq '$($Task.Name)'"
+                $Filter = "PartitionKey eq 'ScheduledTask' and Name eq '$($Task.Name)' and TaskState ne 'Completed' and TaskState ne 'Failed'"
                 $ExistingTask = (Get-CIPPAzDataTableEntity @Table -Filter $Filter)
                 if ($ExistingTask) {
                     return "Task with name $($Task.Name) already exists"
@@ -110,11 +116,7 @@ function Add-CIPPScheduledTask {
             }
             $AdditionalProperties = ([PSCustomObject]$AdditionalProperties | ConvertTo-Json -Compress)
             if ($Parameters -eq 'null') { $Parameters = '' }
-            if (!$Task.RowKey) {
-                $RowKey = (New-Guid).Guid
-            } else {
-                $RowKey = $Task.RowKey
-            }
+
 
             $Recurrence = if ([string]::IsNullOrEmpty($task.Recurrence.value)) {
                 $task.Recurrence
@@ -258,7 +260,46 @@ function Add-CIPPScheduledTask {
                 return "Error - Could not add task: $ErrorMessage"
             }
             Write-LogMessage -headers $Headers -API 'ScheduledTask' -message "Added task $($entity.Name) with ID $($entity.RowKey)" -Sev 'Info' -Tenant $tenantFilter
-            return "Successfully added task: $($entity.Name)"
+
+            # Calculate relative time for next run
+            $scheduledEpoch = [int64]$entity.ScheduledTime
+            $currentTime = [datetime]::UtcNow
+
+            if ($scheduledEpoch -eq 0 -or $scheduledEpoch -le ([int64](($currentTime) - (Get-Date '1/1/1970')).TotalSeconds)) {
+                # Task will run at next 15-minute interval - calculate efficiently
+                $minutesToAdd = 15 - ($currentTime.Minute % 15)
+                $nextRunTime = $currentTime.AddMinutes($minutesToAdd).AddSeconds(-$currentTime.Second).AddMilliseconds(-$currentTime.Millisecond)
+                $timeUntilRun = $nextRunTime - $currentTime
+            } else {
+                # Task is scheduled for a specific time in the future
+                $scheduledTime = [datetime]'1/1/1970' + [TimeSpan]::FromSeconds($scheduledEpoch)
+                $timeUntilRun = $scheduledTime - $currentTime
+            }
+
+            # Format relative time
+            $relativeTime = switch ($timeUntilRun.TotalMinutes) {
+                { $_ -ge 1440 } {
+                    $days = [Math]::Floor($timeUntilRun.TotalDays)
+                    $hours = $timeUntilRun.Hours
+                    $result = "$days day$(if ($days -ne 1) { 's' })"
+                    if ($hours -gt 0) { $result += " and $hours hour$(if ($hours -ne 1) { 's' })" }
+                    $result
+                    break
+                }
+                { $_ -ge 60 } {
+                    $hours = [Math]::Floor($timeUntilRun.TotalHours)
+                    $minutes = $timeUntilRun.Minutes
+                    $result = "$hours hour$(if ($hours -ne 1) { 's' })"
+                    if ($minutes -gt 0) { $result += " and $minutes minute$(if ($minutes -ne 1) { 's' })" }
+                    $result
+                    break
+                }
+                { $_ -ge 2 } { "about $([Math]::Round($_)) minutes"; break }
+                { $_ -ge 1 } { 'about 1 minute'; break }
+                default { 'less than a minute' }
+            }
+
+            return "Successfully added task: $($entity.Name). It will run in $relativeTime."
         }
     } catch {
         Write-Warning "Failed to add scheduled task: $($_.Exception.Message)"
diff --git a/Modules/CIPPCore/Public/Add-CippTestResult.ps1 b/Modules/CIPPCore/Public/Add-CippTestResult.ps1
new file mode 100644
index 000000000000..a4bee90dae78
--- /dev/null
+++ b/Modules/CIPPCore/Public/Add-CippTestResult.ps1
@@ -0,0 +1,101 @@
+function Add-CippTestResult {
+    <#
+    .SYNOPSIS
+        Adds a test result to the CIPP test results database
+
+    .DESCRIPTION
+        Stores test result data in the CippTestResults table with tenant and test ID as keys
+
+    .PARAMETER TenantFilter
+        The tenant domain or GUID for the test result
+
+    .PARAMETER TestId
+        Unique identifier for the test
+
+    .PARAMETER Status
+        Test status (e.g., Pass, Fail, Skip)
+
+    .PARAMETER ResultMarkdown
+        Markdown formatted result details
+
+    .PARAMETER Risk
+        Risk level (e.g., High, Medium, Low)
+
+    .PARAMETER Name
+        Display name of the test
+
+    .PARAMETER Pillar
+        Security pillar category
+
+    .PARAMETER UserImpact
+        Impact level on users
+
+    .PARAMETER ImplementationEffort
+        Effort required for implementation
+
+    .PARAMETER Category
+        Test category or classification
+
+    .EXAMPLE
+        Add-CippTestResult -TenantFilter 'contoso.onmicrosoft.com' -TestId 'MFA-001' -Status 'Pass' -Name 'MFA Enabled' -Risk 'High'
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TestId,
+
+        [Parameter(Mandatory = $false)]
+        [string]$testType = 'Identity',
+
+        [Parameter(Mandatory = $true)]
+        [string]$Status,
+
+        [Parameter(Mandatory = $false)]
+        [string]$ResultMarkdown,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Risk,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Name,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Pillar,
+
+        [Parameter(Mandatory = $false)]
+        [string]$UserImpact,
+
+        [Parameter(Mandatory = $false)]
+        [string]$ImplementationEffort,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Category
+    )
+
+    try {
+        $Table = Get-CippTable -tablename 'CippTestResults'
+
+        $Entity = @{
+            PartitionKey         = $TenantFilter
+            RowKey               = $TestId
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown ?? ''
+            Risk                 = $Risk ?? ''
+            Name                 = $Name ?? ''
+            Pillar               = $Pillar ?? ''
+            UserImpact           = $UserImpact ?? ''
+            ImplementationEffort = $ImplementationEffort ?? ''
+            Category             = $Category ?? ''
+            TestType             = $TestType
+        }
+
+        Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
+        Write-LogMessage -API 'CIPPTestResults' -tenant $TenantFilter -message "Added test result: $TestId - $Status" -sev Debug
+    } catch {
+        Write-LogMessage -API 'CIPPTestResults' -tenant $TenantFilter -message "Failed to add test result: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1
index ac0a0026ae58..30097cd36268 100644
--- a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1
@@ -31,6 +31,8 @@ function Get-CIPPAlertAppSecretExpiry {
                         AppName    = $App.displayName
                         AppId      = $App.appId
                         Expires    = $Credential.endDateTime
+                        SecretName = $Credential.displayName
+                        SecretID   = $Credential.keyId
                         Tenant     = $TenantFilter
                     }
                     $AlertData.Add($Message)
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1
new file mode 100644
index 000000000000..684f6bd0fc87
--- /dev/null
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1
@@ -0,0 +1,144 @@
+function Get-CIPPAlertIntunePolicyConflicts {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $false)]
+        [Alias('input')]
+        $InputValue,
+        $TenantFilter
+    )
+
+    # Normalize JSON/string input to object when possible
+    if ($InputValue -is [string]) {
+        try {
+            if ($InputValue.Trim().StartsWith('{')) {
+                $InputValue = $InputValue | ConvertFrom-Json -ErrorAction Stop
+            }
+        } catch {
+            # Leave as-is if parsing fails
+        }
+    }
+
+    $Config = [ordered]@{
+        AlertEachIssue      = $false   # align with AlertEachAdmin convention (false = aggregated)
+        IncludePolicies     = $true
+        IncludeApplications = $true
+        AlertConflicts      = $true
+        AlertErrors         = $true
+    }
+
+    if ($InputValue -is [hashtable] -or $InputValue -is [pscustomobject]) {
+        # Primary key follows AlertEach* convention; legacy Aggregate supported (true == aggregated)
+        if ($null -ne $InputValue.AlertEachIssue) { $Config.AlertEachIssue = [bool]$InputValue.AlertEachIssue }
+        if ($null -ne $InputValue.Aggregate) { $Config.AlertEachIssue = -not [bool]$InputValue.Aggregate }
+
+        $Config.IncludePolicies = if ($null -ne $InputValue.IncludePolicies) { [bool]$InputValue.IncludePolicies } else { $Config.IncludePolicies }
+        $Config.IncludeApplications = if ($null -ne $InputValue.IncludeApplications) { [bool]$InputValue.IncludeApplications } else { $Config.IncludeApplications }
+        $Config.AlertConflicts = if ($null -ne $InputValue.AlertConflicts) { [bool]$InputValue.AlertConflicts } else { $Config.AlertConflicts }
+        $Config.AlertErrors = if ($null -ne $InputValue.AlertErrors) { [bool]$InputValue.AlertErrors } else { $Config.AlertErrors }
+    } elseif ($InputValue -is [bool]) {
+        # Back-compat for boolean toggle used as Aggregate previously
+        $Config.AlertEachIssue = -not [bool]$InputValue
+    }
+
+    if (-not $Config.IncludePolicies -and -not $Config.IncludeApplications) {
+        return
+    }
+
+    $AlertableStatuses = @()
+    if ($Config.AlertErrors) { $AlertableStatuses += 'error', 'failed' }
+    if ($Config.AlertConflicts) { $AlertableStatuses += 'conflict' }
+
+    if (-not $AlertableStatuses) {
+        return
+    }
+
+    $HasLicense = Test-CIPPStandardLicense -StandardName 'IntunePolicyStatus' -TenantFilter $TenantFilter -RequiredCapabilities @(
+        'INTUNE_A',
+        'MDM_Services',
+        'EMS',
+        'SCCM',
+        'MICROSOFTINTUNEPLAN1'
+    )
+
+    if (-not $HasLicense) {
+        return
+    }
+
+    $Issues = @()
+
+    if ($Config.IncludePolicies) {
+        try {
+            $ManagedDevices = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$select=id,deviceName,userPrincipalName&`$expand=deviceConfigurationStates(`$select=displayName,state,settingStates)" -tenantid $TenantFilter
+
+            foreach ($Device in $ManagedDevices) {
+                $PolicyStates = $Device.deviceConfigurationStates | Where-Object { $_.state -and ($AlertableStatuses -contains $_.state) }
+                foreach ($State in $PolicyStates) {
+                    $Issues += [PSCustomObject]@{
+                        Message           = "Policy '$($State.displayName)' is $($State.state) on device '$($Device.deviceName)' for $($Device.userPrincipalName)."
+                        Tenant            = $TenantFilter
+                        Type              = 'Policy'
+                        PolicyName        = $State.displayName
+                        IssueStatus       = $State.state
+                        DeviceName        = $Device.deviceName
+                        UserPrincipalName = $Device.userPrincipalName
+                        DeviceId          = $Device.id
+                    }
+                }
+            }
+        } catch {
+            Write-AlertMessage -tenant $TenantFilter -message "Failed to query Intune policy states: $(Get-NormalizedError -message $_.Exception.Message)"
+        }
+    }
+
+    if ($Config.IncludeApplications) {
+        try {
+            $Applications = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps?`$select=id,displayName&`$expand=deviceStatuses(`$select=installState,deviceName,userPrincipalName,deviceId)" -tenantid $TenantFilter
+
+            foreach ($App in $Applications) {
+                $BadStatuses = $App.deviceStatuses | Where-Object {
+                    $_.installState -and ($AlertableStatuses -contains $_.installState.ToLowerInvariant())
+                }
+
+                foreach ($Status in $BadStatuses) {
+                    $Issues += [PSCustomObject]@{
+                        Message           = "App '$($App.displayName)' install is $($Status.installState) on device '$($Status.deviceName)' for $($Status.userPrincipalName)."
+                        Tenant            = $TenantFilter
+                        Type              = 'Application'
+                        AppName           = $App.displayName
+                        IssueStatus       = $Status.installState
+                        DeviceName        = $Status.deviceName
+                        UserPrincipalName = $Status.userPrincipalName
+                        DeviceId          = $Status.deviceId
+                    }
+                }
+            }
+        } catch {
+            Write-AlertMessage -tenant $TenantFilter -message "Failed to query Intune application states: $(Get-NormalizedError -message $_.Exception.Message)"
+        }
+    }
+
+    if (-not $Issues) {
+        return
+    }
+
+    if (-not $Config.AlertEachIssue) {
+        $PolicyCount = ($Issues | Where-Object { $_.Type -eq 'Policy' }).Count
+        $AppCount = ($Issues | Where-Object { $_.Type -eq 'Application' }).Count
+
+        $AlertData = @([PSCustomObject]@{
+                Message        = "Found $PolicyCount policy issues and $AppCount application issues in Intune."
+                Tenant         = $TenantFilter
+                PolicyIssues   = $PolicyCount
+                AppIssues      = $AppCount
+                Issues         = $Issues
+            })
+    } else {
+        $AlertData = $Issues
+    }
+
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+}
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1
index 429f342e60fa..f2c268a4ed75 100644
--- a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1
@@ -18,8 +18,10 @@ function Get-CIPPAlertMXRecordChanged {
 
         $ChangedDomains = foreach ($Domain in $DomainData) {
             $PreviousDomain = $PreviousResults | Where-Object { $_.Domain -eq $Domain.Domain }
-            if ($PreviousDomain -and $PreviousDomain.ActualMXRecords -ne $Domain.ActualMXRecords) {
-                "$($Domain.Domain): MX records changed from [$($PreviousDomain.ActualMXRecords -join ', ')] to [$($Domain.ActualMXRecords -join ', ')]"
+            $PreviousRecords = $PreviousDomain.ActualMXRecords -split ',' | Sort-Object
+            $CurrentRecords = $Domain.ActualMXRecords.Hostname | Sort-Object
+            if ($PreviousDomain -and $PreviousRecords -ne $CurrentRecords) {
+                "$($Domain.Domain): MX records changed from [$($PreviousRecords -join ', ')] to [$($CurrentRecords -join ', ')]"
             }
         }
 
@@ -29,11 +31,12 @@ function Get-CIPPAlertMXRecordChanged {
 
         # Update cache with current data
         foreach ($Domain in $DomainData) {
+            $CurrentRecords = $Domain.ActualMXRecords.Hostname | Sort-Object
             $CacheEntity = @{
                 PartitionKey    = [string]$TenantFilter
                 RowKey          = [string]$Domain.Domain
                 Domain          = [string]$Domain.Domain
-                ActualMXRecords = [string]$Domain.ActualMXRecords
+                ActualMXRecords = [string]($CurrentRecords -join ',')
                 LastRefresh     = [string]$Domain.LastRefresh
                 MailProvider    = [string]$Domain.MailProvider
             }
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1
index 34e8f6a87918..d6899a8af1f4 100644
--- a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1
@@ -13,55 +13,45 @@ function Get-CIPPAlertNewAppApproval {
         $Headers
     )
 
-    Measure-CippTask -TaskName 'NewAppApprovalAlert' -EventName 'CIPP.AlertProfile' -Script {
-        try {
-            $Approvals = Measure-CippTask -TaskName 'GetAppConsentRequests' -EventName 'CIPP.AlertProfile' -Script {
-                New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/identityGovernance/appConsent/appConsentRequests?`$top=100&`$filter=userConsentRequests/any (u:u/status eq 'InProgress')" -tenantid $TenantFilter
-            }
-
-            if ($Approvals.count -gt 0) {
-                Measure-CippTask -TaskName 'ProcessApprovals' -EventName 'CIPP.AlertProfile' -Script {
-                    $TenantGUID = (Get-Tenants -TenantFilter $TenantFilter -SkipDomains).customerId
-                    $AlertData = [System.Collections.Generic.List[PSCustomObject]]::new()
+    try {
+        $Approvals = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/identityGovernance/appConsent/appConsentRequests?`$top=100&`$filter=userConsentRequests/any (u:u/status eq 'InProgress')" -tenantid $TenantFilter
 
-                    foreach ($App in $Approvals) {
-                        $userConsentRequests = Measure-CippTask -TaskName 'GetUserConsentRequests' -EventName 'CIPP.AlertProfile' -Script {
-                            New-GraphGetRequest -Uri "https://graph.microsoft.com/v1.0/identityGovernance/appConsent/appConsentRequests/$($App.id)/userConsentRequests" -tenantid $TenantFilter
-                        }
+        if ($Approvals.count -gt 0) {
+            $TenantGUID = (Get-Tenants -TenantFilter $TenantFilter -SkipDomains).customerId
+            $AlertData = [System.Collections.Generic.List[PSCustomObject]]::new()
 
-                        $userConsentRequests | ForEach-Object {
-                            $consentUrl = if ($App.consentType -eq 'Static') {
-                                # if something is going wrong here you've probably stumbled on a fourth variation - rvdwegen
-                                "https://login.microsoftonline.com/$($TenantFilter)/adminConsent?client_id=$($App.appId)&bf_id=$($App.id)&redirect_uri=https://entra.microsoft.com/TokenAuthorize"
-                            } elseif ($App.pendingScopes.displayName) {
-                                "https://login.microsoftonline.com/$($TenantFilter)/v2.0/adminConsent?client_id=$($App.appId)&scope=$($App.pendingScopes.displayName -Join(' '))&bf_id=$($App.id)&redirect_uri=https://entra.microsoft.com/TokenAuthorize"
-                            } else {
-                                "https://login.microsoftonline.com/$($TenantFilter)/adminConsent?client_id=$($App.appId)&bf_id=$($App.id)&redirect_uri=https://entra.microsoft.com/TokenAuthorize"
-                            }
+            foreach ($App in $Approvals) {
+                $userConsentRequests = New-GraphGetRequest -Uri "https://graph.microsoft.com/v1.0/identityGovernance/appConsent/appConsentRequests/$($App.id)/userConsentRequests" -tenantid $TenantFilter
 
-                            $Message = [PSCustomObject]@{
-                                RequestId   = $_.id
-                                AppName     = $App.appDisplayName
-                                RequestUser = $_.createdBy.user.userPrincipalName
-                                Reason      = $_.reason
-                                RequestDate = $_.createdDateTime
-                                Status      = $_.status # Will allways be InProgress as we filter to only get these but this will reduce confusion when an alert is generated
-                                AppId       = $App.appId
-                                Scopes      = ($App.pendingScopes.displayName -join ', ')
-                                ConsentURL  = $consentUrl
-                                Tenant      = $TenantFilter
-                                TenantId    = $TenantGUID
-                            }
-                            $AlertData.Add($Message)
-                        }
+                $userConsentRequests | ForEach-Object {
+                    $consentUrl = if ($App.consentType -eq 'Static') {
+                        # if something is going wrong here you've probably stumbled on a fourth variation - rvdwegen
+                        "https://login.microsoftonline.com/$($TenantFilter)/adminConsent?client_id=$($App.appId)&bf_id=$($App.id)&redirect_uri=https://entra.microsoft.com/TokenAuthorize"
+                    } elseif ($App.pendingScopes.displayName) {
+                        "https://login.microsoftonline.com/$($TenantFilter)/v2.0/adminConsent?client_id=$($App.appId)&scope=$($App.pendingScopes.displayName -Join(' '))&bf_id=$($App.id)&redirect_uri=https://entra.microsoft.com/TokenAuthorize"
+                    } else {
+                        "https://login.microsoftonline.com/$($TenantFilter)/adminConsent?client_id=$($App.appId)&bf_id=$($App.id)&redirect_uri=https://entra.microsoft.com/TokenAuthorize"
                     }
 
-                    Measure-CippTask -TaskName 'WriteAlertTrace' -EventName 'CIPP.AlertProfile' -Script {
-                        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+                    $Message = [PSCustomObject]@{
+                        RequestId   = $_.id
+                        AppName     = $App.appDisplayName
+                        RequestUser = $_.createdBy.user.userPrincipalName
+                        Reason      = $_.reason
+                        RequestDate = $_.createdDateTime
+                        Status      = $_.status # Will always be InProgress as we filter to only get these but this will reduce confusion when an alert is generated
+                        AppId       = $App.appId
+                        Scopes      = ($App.pendingScopes.displayName -join ', ')
+                        ConsentURL  = $consentUrl
+                        Tenant      = $TenantFilter
+                        TenantId    = $TenantGUID
                     }
+                    $AlertData.Add($Message)
                 }
             }
-        } catch {
+
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+    } catch {
     }
 }
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1
index 4cbb4580d160..b39ea94d9a48 100644
--- a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1
@@ -33,15 +33,13 @@ function Get-CIPPAlertOneDriveQuota {
         if ($UsagePercent -gt $InputValue) {
             $GBLeft = [math]::Round(($_.storageAllocatedInBytes - $_.storageUsedInBytes) / 1GB)
             [PSCustomObject]@{
-                Details = @{
-                    Message                 = "$($_.ownerPrincipalName): OneDrive is $UsagePercent% full. OneDrive has $($GBLeft)GB storage left"
-                    Owner                   = $_.ownerPrincipalName
-                    UsagePercent            = $UsagePercent
-                    GBLeft                  = $GBLeft
-                    StorageUsedInBytes      = $_.storageUsedInBytes
-                    StorageAllocatedInBytes = $_.storageAllocatedInBytes
-                    Tenant                  = $TenantFilter
-                }
+                Message                 = "$($_.ownerPrincipalName): OneDrive is $UsagePercent% full. OneDrive has $($GBLeft)GB storage left"
+                Owner                   = $_.ownerPrincipalName
+                UsagePercent            = $UsagePercent
+                GBLeft                  = $GBLeft
+                StorageUsedInBytes      = $_.storageUsedInBytes
+                StorageAllocatedInBytes = $_.storageAllocatedInBytes
+                Tenant                  = $TenantFilter
             }
         }
 
diff --git a/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertSecDefaultsDisabled.ps1 b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertSecDefaultsDisabled.ps1
new file mode 100644
index 000000000000..104cf17e03fa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Alerts/Get-CIPPAlertSecDefaultsDisabled.ps1
@@ -0,0 +1,35 @@
+function Get-CIPPAlertSecDefaultsDisabled {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $false)]
+        [Alias('input')]
+        $InputValue,
+        $TenantFilter
+    )
+
+    try {
+        # Check if Security Defaults is disabled
+        $SecDefaults = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -tenantid $TenantFilter)
+
+        if ($SecDefaults.isEnabled -eq $false) {
+            # Security Defaults is disabled, now check if there are any CA policies
+            $CAPolicies = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies' -tenantid $TenantFilter)
+
+            if (!$CAPolicies -or $CAPolicies.Count -eq 0) {
+                # Security Defaults is off AND no CA policies exist
+                $AlertData = [PSCustomObject]@{
+                    Message = 'Security Defaults is disabled and no Conditional Access policies are configured. This tenant has no baseline security protection.'
+                    Tenant  = $TenantFilter
+                }
+
+                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+            }
+        }
+    } catch {
+        Write-AlertMessage -tenant $($TenantFilter) -message "Security Defaults Disabled Alert: Error occurred: $(Get-NormalizedError -message $_.Exception.message)"
+    }
+}
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CIPPRoleIPRanges.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CIPPRoleIPRanges.ps1
new file mode 100644
index 000000000000..cd4745d5c1b4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Authentication/Get-CIPPRoleIPRanges.ps1
@@ -0,0 +1,51 @@
+function Get-CIPPRoleIPRanges {
+    <#
+    .SYNOPSIS
+        Gets combined IP ranges from a list of roles
+    .DESCRIPTION
+        This function retrieves IP range restrictions from custom roles and returns a consolidated list.
+        Superadmin roles are excluded from IP restrictions.
+    .PARAMETER Roles
+        Array of role names to check for IP restrictions
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [array]$Roles
+    )
+
+    $CombinedIPRanges = [System.Collections.Generic.List[string]]::new()
+
+    # Superadmin is never restricted by IP
+    if ($Roles -contains 'superadmin') {
+        return @('Any')
+    }
+
+    $AccessIPRangeTable = Get-CippTable -tablename 'AccessIPRanges'
+
+    foreach ($Role in $Roles) {
+        try {
+            $IPRangeEntity = Get-CIPPAzDataTableEntity @AccessIPRangeTable -Filter "RowKey eq '$($Role.ToLower())'"
+            if ($IPRangeEntity -and $IPRangeEntity.IPRanges) {
+                $IPRanges = @($IPRangeEntity.IPRanges | ConvertFrom-Json)
+                foreach ($IPRange in $IPRanges) {
+                    if ($IPRange -and -not $CombinedIPRanges.Contains($IPRange)) {
+                        $CombinedIPRanges.Add($IPRange)
+                    }
+                }
+            }
+        } catch {
+            Write-Information "Failed to get IP ranges for role '$Role': $($_.Exception.Message)"
+            continue
+        }
+    }
+
+    # If no IP ranges were found in any role, allow all
+    if ($CombinedIPRanges.Count -eq 0) {
+        return @('Any')
+    }
+
+    return @($CombinedIPRanges) | Sort-Object -Unique
+}
diff --git a/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 b/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
index 6a35cee4fa9e..7def9e058199 100644
--- a/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
+++ b/Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1
@@ -148,8 +148,35 @@ function Test-CIPPAccess {
             $AccessTimings['ResolveUserRoles'] = $swResolveUserRoles.Elapsed.TotalMilliseconds
         }
 
-        #Write-Information ($User | ConvertTo-Json -Depth 5)
-        # Return user permissions
+        $swIPCheck = [System.Diagnostics.Stopwatch]::StartNew()
+        $AllowedIPRanges = Get-CIPPRoleIPRanges -Roles $User.userRoles
+
+        if ($AllowedIPRanges -notcontains 'Any') {
+            $ForwardedFor = $Request.Headers.'x-forwarded-for' -split ',' | Select-Object -First 1
+            $IPRegex = '^(?<IP>(?:\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-fA-F:]+\]|[0-9a-fA-F:]+))(?::\d+)?$'
+            $IPAddress = $ForwardedFor -replace $IPRegex, '$1' -replace '[\[\]]', ''
+            if ($IPAddress) {
+                $IPAllowed = $false
+                foreach ($Range in $AllowedIPRanges) {
+                    if ($IPAddress -eq $Range -or (Test-IpInRange -IPAddress $IPAddress -Range $Range)) {
+                        $IPAllowed = $true
+                        break
+                    }
+                }
+
+                if (-not $IPAllowed -and -not $Request.Params.CIPPEndpoint -eq 'me') {
+                    throw "Access to this CIPP API endpoint is not allowed, your IP address ($IPAddress) is not in the allowed range for your role(s)"
+                }
+            } else {
+                $IPAllowed = $true
+            }
+        } else {
+            $IPAllowed = $true
+        }
+
+        $swIPCheck.Stop()
+        $AccessTimings['IPRangeCheck'] = $swIPCheck.Elapsed.TotalMilliseconds
+
         if ($Request.Params.CIPPEndpoint -eq 'me') {
 
             if (!$User.userRoles) {
@@ -163,6 +190,18 @@ function Test-CIPPAccess {
                     })
             }
 
+            if (!$IPAllowed) {
+                return ([HttpResponseContext]@{
+                        StatusCode = [HttpStatusCode]::OK
+                        Body       = (
+                            @{
+                                'clientPrincipal' = $null
+                                'permissions'     = @()
+                                'message'         = "Your IP address ($IPAddress) is not in the allowed range for your role(s)"
+                            } | ConvertTo-Json -Depth 5)
+                    })
+            }
+
             $swPermsMe = [System.Diagnostics.Stopwatch]::StartNew()
             $Permissions = Get-CippAllowedPermissions -UserRoles $User.userRoles
             $swPermsMe.Stop()
diff --git a/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1 b/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1
index ee24dfd6b620..20f5464d1bfa 100644
--- a/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1
+++ b/Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1
@@ -58,6 +58,13 @@ function Compare-CIPPIntuneObject {
                 [int]$MaxDepth = 20
             )
 
+            # Check for arrays at the start of every recursive call - this catches arrays at any nesting level
+            $isObj1Array = $Object1 -is [Array] -or $Object1 -is [System.Collections.IList]
+            $isObj2Array = $Object2 -is [Array] -or $Object2 -is [System.Collections.IList]
+            if ($isObj1Array -or $isObj2Array) {
+                return
+            }
+
             if ($Depth -ge $MaxDepth) {
                 $result.Add([PSCustomObject]@{
                         Property      = $PropertyPath
@@ -153,34 +160,78 @@ function Compare-CIPPIntuneObject {
                     }
                 }
             } elseif ($Object1 -is [PSCustomObject] -or $Object1.PSObject.Properties.Count -gt 0) {
-                $allPropertyNames = @(
-                    $Object1.PSObject.Properties | Select-Object -ExpandProperty Name
-                    $Object2.PSObject.Properties | Select-Object -ExpandProperty Name
-                ) | Select-Object -Unique
+                # Skip comparison if either object is an array - arrays can't have custom properties set
+                $isObj1Array = $Object1 -is [Array] -or $Object1 -is [System.Collections.IList]
+                $isObj2Array = $Object2 -is [Array] -or $Object2 -is [System.Collections.IList]
+                if ($isObj1Array -or $isObj2Array) {
+                    return
+                }
+                
+                # Safely get property names - ensure objects are not arrays before accessing PSObject.Properties
+                $allPropertyNames = @()
+                try {
+                    if (-not ($Object1 -is [Array] -or $Object1 -is [System.Collections.IList])) {
+                        $allPropertyNames += $Object1.PSObject.Properties | Select-Object -ExpandProperty Name
+                    }
+                    if (-not ($Object2 -is [Array] -or $Object2 -is [System.Collections.IList])) {
+                        $allPropertyNames += $Object2.PSObject.Properties | Select-Object -ExpandProperty Name
+                    }
+                    $allPropertyNames = $allPropertyNames | Select-Object -Unique
+                } catch {
+                    return
+                }
 
                 foreach ($propName in $allPropertyNames) {
                     if (ShouldSkipProperty -PropertyName $propName) { continue }
 
                     $newPath = if ($PropertyPath) { "$PropertyPath.$propName" } else { $propName }
-                    $prop1Exists = $Object1.PSObject.Properties.Name -contains $propName
-                    $prop2Exists = $Object2.PSObject.Properties.Name -contains $propName
+                    # Safely check if properties exist - ensure objects are not arrays
+                    $prop1Exists = $false
+                    $prop2Exists = $false
+                    try {
+                        if (-not ($Object1 -is [Array] -or $Object1 -is [System.Collections.IList])) {
+                            $prop1Exists = $Object1.PSObject.Properties.Name -contains $propName
+                        }
+                        if (-not ($Object2 -is [Array] -or $Object2 -is [System.Collections.IList])) {
+                            $prop2Exists = $Object2.PSObject.Properties.Name -contains $propName
+                        }
+                    } catch {
+                        continue
+                    }
 
                     if ($prop1Exists -and $prop2Exists) {
-                        if ($Object1.$propName -and $Object2.$propName) {
-                            Compare-ObjectsRecursively -Object1 $Object1.$propName -Object2 $Object2.$propName -PropertyPath $newPath -Depth ($Depth + 1) -MaxDepth $MaxDepth
+                        try {
+                            # Double-check arrays before accessing properties
+                            if (($Object1 -is [Array] -or $Object1 -is [System.Collections.IList]) -or 
+                                ($Object2 -is [Array] -or $Object2 -is [System.Collections.IList])) {
+                                continue
+                            }
+                            if ($Object1.$propName -and $Object2.$propName) {
+                                Compare-ObjectsRecursively -Object1 $Object1.$propName -Object2 $Object2.$propName -PropertyPath $newPath -Depth ($Depth + 1) -MaxDepth $MaxDepth
+                            }
+                        } catch {
+                            throw
                         }
                     } elseif ($prop1Exists) {
-                        $result.Add([PSCustomObject]@{
-                                Property      = $newPath
-                                ExpectedValue = $Object1.$propName
-                                ReceivedValue = ''
-                            })
+                        try {
+                            $result.Add([PSCustomObject]@{
+                                    Property      = $newPath
+                                    ExpectedValue = $Object1.$propName
+                                    ReceivedValue = ''
+                                })
+                        } catch {
+                            throw
+                        }
                     } else {
-                        $result.Add([PSCustomObject]@{
-                                Property      = $newPath
-                                ExpectedValue = ''
-                                ReceivedValue = $Object2.$propName
-                            })
+                        try {
+                            $result.Add([PSCustomObject]@{
+                                    Property      = $newPath
+                                    ExpectedValue = ''
+                                    ReceivedValue = $Object2.$propName
+                                })
+                        } catch {
+                            throw
+                        }
                     }
                 }
             } else {
diff --git a/Modules/CIPPCore/Public/CustomData/Invoke-CustomDataSync.ps1 b/Modules/CIPPCore/Public/CustomData/Invoke-CustomDataSync.ps1
index 2e96f68871a9..f49792e6b003 100644
--- a/Modules/CIPPCore/Public/CustomData/Invoke-CustomDataSync.ps1
+++ b/Modules/CIPPCore/Public/CustomData/Invoke-CustomDataSync.ps1
@@ -12,7 +12,7 @@ function Invoke-CustomDataSync {
     }
 
     Write-Information "Found $($Mappings.Count) Custom Data mappings"
-    $Mappings = $Mappings | Where-Object { $_.sourceType.value -eq 'extensionSync' -and $_.tenantFilter.value -contains $TenantFilter -or $_.tenantFilter.value -contains 'AllTenants' }
+    $Mappings = $Mappings | Where-Object { ($_.sourceType.value -eq 'reportingDb' -or $_.sourceType.value -eq 'extensionSync') -and ($_.tenantFilter.value -contains $TenantFilter -or $_.tenantFilter.value -contains 'AllTenants') }
 
     if ($Mappings.Count -eq 0) {
         Write-Warning "No Custom Data mappings found for tenant $TenantFilter"
@@ -20,7 +20,7 @@ function Invoke-CustomDataSync {
     }
 
     Write-Information "Getting cached data for tenant $TenantFilter"
-    $Cache = Get-ExtensionCacheData -TenantFilter $TenantFilter
+    $Cache = Get-CippExtensionReportingData -TenantFilter $TenantFilter -IncludeMailboxes
     $BulkRequests = [System.Collections.Generic.List[object]]::new()
     $DirectoryObjectQueries = [System.Collections.Generic.List[object]]::new()
     $SyncConfigs = foreach ($Mapping in $Mappings) {
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1
index 09eabf880be8..f4cc20ab450b 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1	
@@ -157,7 +157,7 @@ function Push-BECRun {
             NewRules                 = @($RulesLog)
             MailboxPermissionChanges = @($PermissionsLog)
             NewUsers                 = @($NewUsers)
-            MFADevices               = @($MFADevices)
+            MFADevices               = @($MFADevices | Where-Object { $_.'@odata.type' -ne '#microsoft.graph.passwordAuthenticationMethod' })
             ChangedPasswords         = @($PasswordChanges)
             ExtractedAt              = (Get-Date)
             ExtractResult            = $ExtractResult
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1
new file mode 100644
index 000000000000..a6a68cfc8510
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1	
@@ -0,0 +1,41 @@
+function Push-ExecCIPPDBCache {
+    <#
+    .SYNOPSIS
+        Generic wrapper to execute CIPP DB cache functions
+
+    .DESCRIPTION
+        Executes the specified Set-CIPPDBCache* function with the provided parameters
+
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param($Item)
+
+    $Name = $Item.Name
+    $TenantFilter = $Item.TenantFilter
+
+    try {
+        Write-Information "Collecting $Name for tenant $TenantFilter"
+
+        # Build the full function name
+        $FullFunctionName = "Set-CIPPDBCache$Name"
+
+        # Check if function exists
+        $Function = Get-Command -Name $FullFunctionName -ErrorAction SilentlyContinue
+        if (-not $Function) {
+            throw "Function $FullFunctionName does not exist"
+        }
+
+        # Execute the cache function
+        & $FullFunctionName -TenantFilter $TenantFilter
+
+        Write-Information "Completed $Name for tenant $TenantFilter"
+        return "Successfully executed $Name for tenant $TenantFilter"
+
+    } catch {
+        $ErrorMsg = "Failed to execute $Name for tenant $TenantFilter : $($_.Exception.Message)"
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message $ErrorMsg -sev Error
+        throw $ErrorMsg
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetMailboxPermissionsBatch.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetMailboxPermissionsBatch.ps1
new file mode 100644
index 000000000000..d86c51cd10a6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetMailboxPermissionsBatch.ps1	
@@ -0,0 +1,103 @@
+function Push-GetMailboxPermissionsBatch {
+    <#
+    .SYNOPSIS
+        Process a batch of mailbox permission queries
+
+    .DESCRIPTION
+        Queries mailbox permissions for a batch of mailboxes and stores in the reporting database
+
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    param($Item)
+
+    $TenantFilter = $Item.TenantFilter
+    $Mailboxes = $Item.Mailboxes
+    $BatchNumber = $Item.BatchNumber
+    $TotalBatches = $Item.TotalBatches
+
+    try {
+        Write-Information "Processing batch $BatchNumber of $TotalBatches for tenant $TenantFilter with $($Mailboxes.Count) mailboxes"
+        Write-Information "Mailbox UPNs in batch: $($Mailboxes -join ', ')"
+
+        # Build bulk requests for this batch (2 queries per mailbox: MailboxPermission + RecipientPermission)
+        # Calendar permissions require locale-specific folder names and will be collected separately if needed
+        $ExoBulkRequests = foreach ($MailboxUPN in $Mailboxes) {
+            @{
+                CmdletInput = @{
+                    CmdletName = 'Get-MailboxPermission'
+                    Parameters = @{ Identity = $MailboxUPN }
+                }
+            }
+            @{
+                CmdletInput = @{
+                    CmdletName = 'Get-RecipientPermission'
+                    Parameters = @{ Identity = $MailboxUPN }
+                }
+            }
+        }
+
+        Write-Information "Built $($ExoBulkRequests.Count) bulk requests for batch $BatchNumber"
+
+        # Execute bulk request for this batch with ReturnWithCommand to separate permission types
+        $MailboxPermissions = New-ExoBulkRequest -cmdletArray @($ExoBulkRequests) -tenantid $TenantFilter -ReturnWithCommand $true
+
+        Write-Information "Bulk request completed. Result type: $($MailboxPermissions.GetType().Name)"
+        if ($MailboxPermissions -is [hashtable]) {
+            Write-Information "Result keys: $($MailboxPermissions.Keys -join ', ')"
+            if ($MailboxPermissions['Get-MailboxPermission']) {
+                Write-Information "Sample MailboxPermission: $($MailboxPermissions['Get-MailboxPermission'][0] | ConvertTo-Json -Depth 2 -Compress)"
+            }
+            if ($MailboxPermissions['Get-RecipientPermission']) {
+                Write-Information "Sample RecipientPermission: $($MailboxPermissions['Get-RecipientPermission'][0] | ConvertTo-Json -Depth 2 -Compress)"
+            }
+        }
+
+        # Normalize MailboxPermission results
+        if ($MailboxPermissions['Get-MailboxPermission']) {
+            $NormalizedMailboxPerms = foreach ($Perm in $MailboxPermissions['Get-MailboxPermission']) {
+                # Create normalized object with consistent property names and unique ID
+                [PSCustomObject]@{
+                    id           = [guid]::NewGuid().ToString()
+                    Identity     = $Perm.Identity
+                    User         = $Perm.User
+                    AccessRights = $Perm.AccessRights
+                    IsInherited  = $Perm.IsInherited
+                    Deny         = $Perm.Deny
+                }
+            }
+            $MailboxPermissions['Get-MailboxPermission'] = $NormalizedMailboxPerms
+        }
+
+        # Normalize the results - RecipientPermission uses 'Trustee' instead of 'User'
+        if ($MailboxPermissions['Get-RecipientPermission']) {
+            $NormalizedRecipientPerms = foreach ($Perm in $MailboxPermissions['Get-RecipientPermission']) {
+                # Create normalized object with consistent property names and unique ID
+                [PSCustomObject]@{
+                    id           = [guid]::NewGuid().ToString()
+                    Identity     = $Perm.Identity
+                    User         = if ($Perm.Trustee) { $Perm.Trustee } else { $Perm.User }
+                    AccessRights = $Perm.AccessRights
+                    IsInherited  = $Perm.IsInherited
+                    Deny         = $Perm.Deny
+                }
+            }
+            $MailboxPermissions['Get-RecipientPermission'] = $NormalizedRecipientPerms
+        }
+
+        $MailboxPermCount = if ($MailboxPermissions['Get-MailboxPermission']) { $MailboxPermissions['Get-MailboxPermission'].Count } else { 0 }
+        $RecipientPermCount = if ($MailboxPermissions['Get-RecipientPermission']) { $MailboxPermissions['Get-RecipientPermission'].Count } else { 0 }
+
+        Write-Information "Completed batch $BatchNumber of $TotalBatches - processed $($Mailboxes.Count) mailboxes: $MailboxPermCount mailbox permissions, $RecipientPermCount recipient permissions"
+
+        # Return results to be aggregated by post-execution function
+        return $MailboxPermissions
+
+    } catch {
+        $ErrorMsg = "Failed to process batch $BatchNumber of $TotalBatches for tenant $TenantFilter : $($_.Exception.Message)"
+        Write-Information "ERROR in Push-GetMailboxPermissionsBatch: $ErrorMsg"
+        Write-Information "Stack trace: $($_.ScriptStackTrace)"
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message $ErrorMsg -sev Error
+        throw $ErrorMsg
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-StoreMailboxPermissions.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-StoreMailboxPermissions.ps1
new file mode 100644
index 000000000000..fc5a967664b3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-StoreMailboxPermissions.ps1	
@@ -0,0 +1,80 @@
+function Push-StoreMailboxPermissions {
+    <#
+    .SYNOPSIS
+        Post-execution function to aggregate and store all mailbox permissions
+
+    .DESCRIPTION
+        Collects results from all batches and stores them in the reporting database
+
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param($Item)
+
+    $TenantFilter = $Item.Parameters.TenantFilter
+    $Results = $Item.Results
+
+    try {
+        Write-Information "Storing mailbox permissions for tenant $TenantFilter"
+        Write-Information "Received $($Results.Count) batch results"
+
+        # Log each result for debugging
+        for ($i = 0; $i -lt $Results.Count; $i++) {
+            $result = $Results[$i]
+            Write-Information "Result $i type: $($result.GetType().Name), value: $($result | ConvertTo-Json -Depth 2 -Compress)"
+        }
+
+        # Aggregate results by command type from all batches
+        $AllMailboxPermissions = [System.Collections.Generic.List[object]]::new()
+        $AllRecipientPermissions = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($BatchResult in $Results) {
+            # Activity functions may return an array [hashtable, "status message"]
+            # Extract the actual hashtable if result is an array
+            $ActualResult = $BatchResult
+            if ($BatchResult -is [array] -and $BatchResult.Count -gt 0) {
+                Write-Information "Result is array with $($BatchResult.Count) elements, extracting first element"
+                $ActualResult = $BatchResult[0]
+            }
+
+            if ($ActualResult -and $ActualResult -is [hashtable]) {
+                Write-Information "Processing hashtable result with keys: $($ActualResult.Keys -join ', ')"
+                # Results are grouped by cmdlet name due to ReturnWithCommand
+                if ($ActualResult['Get-MailboxPermission']) {
+                    Write-Information "Adding $($ActualResult['Get-MailboxPermission'].Count) mailbox permissions"
+                    $AllMailboxPermissions.AddRange($ActualResult['Get-MailboxPermission'])
+                }
+                if ($ActualResult['Get-RecipientPermission']) {
+                    Write-Information "Adding $($ActualResult['Get-RecipientPermission'].Count) recipient permissions"
+                    $AllRecipientPermissions.AddRange($ActualResult['Get-RecipientPermission'])
+                }
+            } else {
+                Write-Information "Skipping non-hashtable result: $($ActualResult.GetType().Name)"
+            }
+        }
+
+# Combine all permissions (mailbox and recipient) into a single collection
+        $AllPermissions = [System.Collections.Generic.List[object]]::new()
+        $AllPermissions.AddRange($AllMailboxPermissions)
+        $AllPermissions.AddRange($AllRecipientPermissions)
+
+        Write-Information "Aggregated $($AllPermissions.Count) total permissions ($($AllMailboxPermissions.Count) mailbox + $($AllRecipientPermissions.Count) recipient)"
+
+        # Store all permissions together as MailboxPermissions
+        if ($AllPermissions.Count -gt 0) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailboxPermissions' -Data $AllPermissions
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailboxPermissions' -Data $AllPermissions -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AllPermissions.Count) mailbox permission records" -sev Info
+        } else {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No permissions found to cache' -sev Info
+        }
+
+        return
+
+    } catch {
+        $ErrorMsg = "Failed to store mailbox permissions for tenant $TenantFilter : $($_.Exception.Message)"
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message $ErrorMsg -sev Error
+        throw $ErrorMsg
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1
new file mode 100644
index 000000000000..d2c0f155009e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1	
@@ -0,0 +1,392 @@
+function Push-CIPPDBCacheData {
+    <#
+    .SYNOPSIS
+        Activity function to collect and cache all data for a single tenant
+
+    .DESCRIPTION
+        Calls all collection functions sequentially, storing data immediately after each collection
+
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param($Item)
+    Write-Host "Starting cache collection for tenant: $($Item.TenantFilter) - Queue: $($Item.QueueName) (ID: $($Item.QueueId))"
+    $TenantFilter = $Item.TenantFilter
+    $Type = $Item.Type ?? 'Default'
+
+    #This collects all data for a tenant and caches it in the CIPP Reporting database. DO NOT ADD PROCESSING OR LOGIC HERE.
+    #The point of this file is to always be <10 minutes execution time.
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Starting database cache collection for tenant' -sev Info
+
+        # Check tenant capabilities for license-specific features
+        $IntuneCapable = Test-CIPPStandardLicense -StandardName 'IntuneLicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1') -SkipLog
+        $ConditionalAccessCapable = Test-CIPPStandardLicense -StandardName 'ConditionalAccessLicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('AAD_PREMIUM', 'AAD_PREMIUM_P2') -SkipLog
+        $AzureADPremiumP2Capable = Test-CIPPStandardLicense -StandardName 'AzureADPremiumP2LicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('AAD_PREMIUM_P2') -SkipLog
+        $ExchangeCapable = Test-CIPPStandardLicense -StandardName 'ExchangeLicenseCheck' -TenantFilter $TenantFilter -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_S_STANDARD_GOV', 'EXCHANGE_S_ENTERPRISE_GOV', 'EXCHANGE_LITE') -SkipLog
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "License capabilities - Intune: $IntuneCapable, Conditional Access: $ConditionalAccessCapable, Azure AD Premium P2: $AzureADPremiumP2Capable, Exchange: $ExchangeCapable" -sev Info
+
+        switch ($Type) {
+            'Default' {
+                #region All Licenses - Basic tenant data collection
+                Write-Host 'Getting cache for Users'
+                try { Set-CIPPDBCacheUsers -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Users collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Groups'
+                try { Set-CIPPDBCacheGroups -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Groups collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Guests'
+                try { Set-CIPPDBCacheGuests -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Guests collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for ServicePrincipals'
+                try { Set-CIPPDBCacheServicePrincipals -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ServicePrincipals collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Apps'
+                try { Set-CIPPDBCacheApps -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Apps collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Devices'
+                try { Set-CIPPDBCacheDevices -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Devices collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Organization'
+                try { Set-CIPPDBCacheOrganization -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Organization collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Roles'
+                try { Set-CIPPDBCacheRoles -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Roles collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for AdminConsentRequestPolicy'
+                try { Set-CIPPDBCacheAdminConsentRequestPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AdminConsentRequestPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for AuthorizationPolicy'
+                try { Set-CIPPDBCacheAuthorizationPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AuthorizationPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for AuthenticationMethodsPolicy'
+                try { Set-CIPPDBCacheAuthenticationMethodsPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AuthenticationMethodsPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for DeviceSettings'
+                try { Set-CIPPDBCacheDeviceSettings -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DeviceSettings collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for DirectoryRecommendations'
+                try { Set-CIPPDBCacheDirectoryRecommendations -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DirectoryRecommendations collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for CrossTenantAccessPolicy'
+                try { Set-CIPPDBCacheCrossTenantAccessPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "CrossTenantAccessPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for DefaultAppManagementPolicy'
+                try { Set-CIPPDBCacheDefaultAppManagementPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DefaultAppManagementPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Settings'
+                try { Set-CIPPDBCacheSettings -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Settings collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for SecureScore'
+                try { Set-CIPPDBCacheSecureScore -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "SecureScore collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for PIMSettings'
+                try { Set-CIPPDBCachePIMSettings -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "PIMSettings collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for Domains'
+                try { Set-CIPPDBCacheDomains -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Domains collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for RoleEligibilitySchedules'
+                try { Set-CIPPDBCacheRoleEligibilitySchedules -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RoleEligibilitySchedules collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for RoleManagementPolicies'
+                try { Set-CIPPDBCacheRoleManagementPolicies -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RoleManagementPolicies collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for RoleAssignmentScheduleInstances'
+                try { Set-CIPPDBCacheRoleAssignmentScheduleInstances -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RoleAssignmentScheduleInstances collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for B2BManagementPolicy'
+                try { Set-CIPPDBCacheB2BManagementPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "B2BManagementPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for AuthenticationFlowsPolicy'
+                try { Set-CIPPDBCacheAuthenticationFlowsPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AuthenticationFlowsPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for DeviceRegistrationPolicy'
+                try { Set-CIPPDBCacheDeviceRegistrationPolicy -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "DeviceRegistrationPolicy collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for CredentialUserRegistrationDetails'
+                try { Set-CIPPDBCacheCredentialUserRegistrationDetails -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "CredentialUserRegistrationDetails collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for UserRegistrationDetails'
+                try { Set-CIPPDBCacheUserRegistrationDetails -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "UserRegistrationDetails collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for OAuth2PermissionGrants'
+                try { Set-CIPPDBCacheOAuth2PermissionGrants -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "OAuth2PermissionGrants collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for AppRoleAssignments'
+                try { Set-CIPPDBCacheAppRoleAssignments -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "AppRoleAssignments collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for License Overview'
+                try { Set-CIPPDBCacheLicenseOverview -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "License Overview collection failed: $($_.Exception.Message)" -sev Error
+                }
+
+                Write-Host 'Getting cache for MFA State'
+                try { Set-CIPPDBCacheMFAState -TenantFilter $TenantFilter } catch {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "MFA State collection failed: $($_.Exception.Message)" -sev Error
+                }
+                #endregion All Licenses
+
+                #region Exchange Licensed - Exchange Online features
+                if ($ExchangeCapable) {
+                    Write-Host 'Getting cache for ExoAntiPhishPolicies'
+                    try { Set-CIPPDBCacheExoAntiPhishPolicies -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoAntiPhishPolicies collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoMalwareFilterPolicies'
+                    try { Set-CIPPDBCacheExoMalwareFilterPolicies -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoMalwareFilterPolicies collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoSafeLinksPolicies'
+                    try { Set-CIPPDBCacheExoSafeLinksPolicies -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoSafeLinksPolicies collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoSafeAttachmentPolicies'
+                    try { Set-CIPPDBCacheExoSafeAttachmentPolicies -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoSafeAttachmentPolicies collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoTransportRules'
+                    try { Set-CIPPDBCacheExoTransportRules -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoTransportRules collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoDkimSigningConfig'
+                    try { Set-CIPPDBCacheExoDkimSigningConfig -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoDkimSigningConfig collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoOrganizationConfig'
+                    try { Set-CIPPDBCacheExoOrganizationConfig -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoOrganizationConfig collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoAcceptedDomains'
+                    try { Set-CIPPDBCacheExoAcceptedDomains -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoAcceptedDomains collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoHostedContentFilterPolicy'
+                    try { Set-CIPPDBCacheExoHostedContentFilterPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoHostedContentFilterPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoHostedOutboundSpamFilterPolicy'
+                    try { Set-CIPPDBCacheExoHostedOutboundSpamFilterPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoHostedOutboundSpamFilterPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoAntiPhishPolicy'
+                    try { Set-CIPPDBCacheExoAntiPhishPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoAntiPhishPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoSafeLinksPolicy'
+                    try { Set-CIPPDBCacheExoSafeLinksPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoSafeLinksPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoSafeAttachmentPolicy'
+                    try { Set-CIPPDBCacheExoSafeAttachmentPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoSafeAttachmentPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoMalwareFilterPolicy'
+                    try { Set-CIPPDBCacheExoMalwareFilterPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoMalwareFilterPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoAtpPolicyForO365'
+                    try { Set-CIPPDBCacheExoAtpPolicyForO365 -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoAtpPolicyForO365 collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoQuarantinePolicy'
+                    try { Set-CIPPDBCacheExoQuarantinePolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoQuarantinePolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoRemoteDomain'
+                    try { Set-CIPPDBCacheExoRemoteDomain -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoRemoteDomain collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoSharingPolicy'
+                    try { Set-CIPPDBCacheExoSharingPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoSharingPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoAdminAuditLogConfig'
+                    try { Set-CIPPDBCacheExoAdminAuditLogConfig -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoAdminAuditLogConfig collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoPresetSecurityPolicy'
+                    try { Set-CIPPDBCacheExoPresetSecurityPolicy -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoPresetSecurityPolicy collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ExoTenantAllowBlockList'
+                    try { Set-CIPPDBCacheExoTenantAllowBlockList -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ExoTenantAllowBlockList collection failed: $($_.Exception.Message)" -sev Error
+                    }
+                } else {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Exchange Online data collection - tenant does not have required license' -sev Info
+                }
+                #endregion Exchange Licensed
+
+                #region Conditional Access Licensed - Azure AD Premium features
+                if ($ConditionalAccessCapable) {
+                    Write-Host 'Getting cache for ConditionalAccessPolicies'
+                    try { Set-CIPPDBCacheConditionalAccessPolicies -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ConditionalAccessPolicies collection failed: $($_.Exception.Message)" -sev Error
+                    }
+                } else {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Conditional Access data collection - tenant does not have required license' -sev Info
+                }
+                #endregion Conditional Access Licensed
+
+                #region Azure AD Premium P2 - Identity Protection features
+                if ($AzureADPremiumP2Capable) {
+                    Write-Host 'Getting cache for RiskyUsers'
+                    try { Set-CIPPDBCacheRiskyUsers -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyUsers collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for RiskyServicePrincipals'
+                    try { Set-CIPPDBCacheRiskyServicePrincipals -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskyServicePrincipals collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ServicePrincipalRiskDetections'
+                    try { Set-CIPPDBCacheServicePrincipalRiskDetections -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ServicePrincipalRiskDetections collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for RiskDetections'
+                    try { Set-CIPPDBCacheRiskDetections -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "RiskDetections collection failed: $($_.Exception.Message)" -sev Error
+                    }
+                } else {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Azure AD Premium P2 Identity Protection data collection - tenant does not have required license' -sev Info
+                }
+                #endregion Azure AD Premium P2
+
+                #region Intune Licensed - Intune management features
+                if ($IntuneCapable) {
+                    Write-Host 'Getting cache for ManagedDevices'
+                    try { Set-CIPPDBCacheManagedDevices -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ManagedDevices collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for IntunePolicies'
+                    try { Set-CIPPDBCacheIntunePolicies -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "IntunePolicies collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for ManagedDeviceEncryptionStates'
+                    try { Set-CIPPDBCacheManagedDeviceEncryptionStates -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "ManagedDeviceEncryptionStates collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for IntuneAppProtectionPolicies'
+                    try { Set-CIPPDBCacheIntuneAppProtectionPolicies -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "IntuneAppProtectionPolicies collection failed: $($_.Exception.Message)" -sev Error
+                    }
+                } else {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Intune data collection - tenant does not have required license' -sev Info
+                }
+                #endregion Intune Licensed
+            }
+            'Mailboxes' {
+                if ($ExchangeCapable) {
+                    Write-Host 'Getting cache for Mailboxes'
+                    try { Set-CIPPDBCacheMailboxes -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Mailboxes collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for MailboxUsage'
+                    try { Set-CIPPDBCacheMailboxUsage -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "MailboxUsage collection failed: $($_.Exception.Message)" -sev Error
+                    }
+
+                    Write-Host 'Getting cache for OneDriveUsage'
+                    try { Set-CIPPDBCacheOneDriveUsage -TenantFilter $TenantFilter } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "OneDriveUsage collection failed: $($_.Exception.Message)" -sev Error
+                    }
+                } else {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Skipping Mailboxes data collection - tenant does not have required Exchange license' -sev Info
+                }
+            }
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Completed database cache collection for tenant' -sev Info
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to complete database cache collection: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1
index d199f7c5ada2..ccc7249ed798 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1	
@@ -20,6 +20,9 @@ function Push-ExecScheduledCommand {
     # Handle tenant resolution - support both direct tenant and group-expanded tenants
     $Tenant = $Item.Parameters.TenantFilter ?? $Item.TaskInfo.Tenant
 
+    # Detect if this is a multi-tenant task that should store results per-tenant
+    $IsMultiTenantTask = ($task.Tenant -eq 'AllTenants' -or $task.TenantGroup)
+
     # For tenant group tasks, the tenant will be the expanded tenant from the orchestrator
     # We don't need to expand groups here as that's handled in the orchestrator
     $TenantInfo = Get-Tenants -TenantFilter $Tenant
@@ -30,11 +33,53 @@ function Push-ExecScheduledCommand {
         Remove-Variable -Name ScheduledTaskId -Scope Script -ErrorAction SilentlyContinue
         return
     }
-    if ($CurrentTask.TaskState -eq 'Completed') {
+    if ($CurrentTask.TaskState -eq 'Completed' -and !$IsMultiTenantTask) {
         Write-Information "The task $($task.Name) for tenant $($task.Tenant) is already completed. Skipping execution."
         Remove-Variable -Name ScheduledTaskId -Scope Script -ErrorAction SilentlyContinue
         return
     }
+    # Task should be 'Pending' (queued by orchestrator) or 'Running' (retry/recovery)
+    # We accept both to handle edge cases
+
+    # Check for rerun protection - prevent duplicate executions within the recurrence interval
+    if ($task.Recurrence -and $task.Recurrence -ne '0') {
+        # Calculate interval in seconds from recurrence string
+        $IntervalSeconds = switch -Regex ($task.Recurrence) {
+            '^(\d+)$' { [int64]$matches[1] * 86400 }  # Plain number = days
+            '(\d+)m$' { [int64]$matches[1] * 60 }
+            '(\d+)h$' { [int64]$matches[1] * 3600 }
+            '(\d+)d$' { [int64]$matches[1] * 86400 }
+            default { 0 }
+        }
+
+        if ($IntervalSeconds -gt 0) {
+            # Round down to nearest 15-minute interval (900 seconds) since that's when orchestrator runs
+            # This prevents rerun blocking issues due to slight timing variations
+            $FifteenMinutes = 900
+            $AdjustedInterval = [Math]::Floor($IntervalSeconds / $FifteenMinutes) * $FifteenMinutes
+
+            # Ensure we have at least one 15-minute interval
+            if ($AdjustedInterval -lt $FifteenMinutes) {
+                $AdjustedInterval = $FifteenMinutes
+            }
+            # Use task RowKey as API identifier for rerun cache
+            $RerunParams = @{
+                TenantFilter = $Tenant
+                Type         = 'ScheduledTask'
+                API          = $task.RowKey
+                Interval     = $AdjustedInterval
+                BaseTime     = [int64]$task.ScheduledTime
+                Headers      = $Headers
+            }
+
+            $IsRerun = Test-CIPPRerun @RerunParams
+            if ($IsRerun) {
+                Write-Information "Scheduled task $($task.Name) for tenant $Tenant was recently executed. Skipping to prevent duplicate execution."
+                Remove-Variable -Name ScheduledTaskId -Scope Script -ErrorAction SilentlyContinue
+                return
+            }
+        }
+    }
 
     if ($task.Trigger) {
         # Extract trigger data from the task and process
@@ -220,7 +265,7 @@ function Push-ExecScheduledCommand {
             }
         }
         Write-Information "Results: $($results | ConvertTo-Json -Depth 10)"
-        if ($StoredResults.Length -gt 64000 -or $task.Tenant -eq 'AllTenants' -or $task.TenantGroup) {
+        if ($StoredResults.Length -gt 64000 -or $IsMultiTenantTask) {
             $TaskResultsTable = Get-CippTable -tablename 'ScheduledTaskResults'
             $TaskResults = @{
                 PartitionKey = $task.RowKey
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1
index 020ff3a469f9..996c224490d9 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1	
@@ -16,9 +16,9 @@ function Push-CIPPStandard {
     Write-Information "We'll be running $FunctionName"
 
     if ($Standard -in @('IntuneTemplate', 'ConditionalAccessTemplate')) {
-        $API = "$($Standard)_$($Item.templateId)_$($Item.Settings.TemplateList.value)"
+        $API = "$($Standard)_$($Item.TemplateId)_$($Item.Settings.TemplateList.value)"
     } else {
-        $API = "$($Standard)_$($Item.templateId)"
+        $API = "$($Standard)_$($Item.TemplateId)"
     }
 
     $Rerun = Test-CIPPRerun -Type Standard -Tenant $Tenant -API $API
@@ -31,7 +31,7 @@ function Push-CIPPStandard {
 
     $StandardInfo = @{
         Standard           = $Standard
-        StandardTemplateId = $Item.templateId
+        StandardTemplateId = $Item.TemplateId
     }
     if ($Standard -eq 'IntuneTemplate') {
         $StandardInfo.IntuneTemplateId = $Item.Settings.TemplateList.value
@@ -64,7 +64,7 @@ function Push-CIPPStandard {
             InvocationId = $invocationId
             Tenant       = $Tenant
             Standard     = $Standard
-            TemplateId   = $Item.templateId
+            TemplateId   = $Item.TemplateId
             API          = $API
             FunctionName = $FunctionName
         } | ConvertTo-Json -Compress)
@@ -83,7 +83,7 @@ function Push-CIPPStandard {
         $metadata = @{
             Standard     = $Standard
             Tenant       = $Tenant
-            TemplateId   = $Item.templateId
+            TemplateId   = $Item.TemplateId
             FunctionName = $FunctionName
             TriggerType  = 'Standard'
         }
@@ -118,7 +118,7 @@ function Push-CIPPStandard {
                 InvocationId = $invocationId
                 Tenant       = $Tenant
                 Standard     = $Standard
-                TemplateId   = $Item.templateId
+                TemplateId   = $Item.TemplateId
                 API          = $API
                 FunctionName = $FunctionName
                 Result       = $result
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Invoke-CIPPTestsRun.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Invoke-CIPPTestsRun.ps1
new file mode 100644
index 000000000000..9cc264d9af27
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Invoke-CIPPTestsRun.ps1	
@@ -0,0 +1,78 @@
+function Invoke-CIPPTestsRun {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Tests.Read
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string]$TenantFilter = 'allTenants'
+    )
+
+    Write-Information "Starting tests run for tenant: $TenantFilter"
+
+    try {
+        $AllTests = Get-Command -Name 'Invoke-CippTest*' -Module CIPPCore | Select-Object -ExpandProperty Name | ForEach-Object {
+            $_ -replace '^Invoke-CippTest', ''
+        }
+
+        if ($AllTests.Count -eq 0) {
+            Write-LogMessage -API 'Tests' -message 'No test functions found.' -sev Error
+            return
+        }
+
+        Write-Information "Found $($AllTests.Count) test functions to run"
+        $AllTenantsList = if ($TenantFilter -eq 'allTenants') {
+            $DbCounts = Get-CIPPDbItem -CountsOnly -TenantFilter 'allTenants'
+            $TenantsWithData = $DbCounts | Where-Object { $_.Count -gt 0 } | Select-Object -ExpandProperty PartitionKey -Unique
+            Write-Information "Found $($TenantsWithData.Count) tenants with data in database"
+            $TenantsWithData
+        } else {
+            $DbCounts = Get-CIPPDbItem -TenantFilter $TenantFilter -CountsOnly
+            if (($DbCounts | Measure-Object -Property Count -Sum).Sum -gt 0) {
+                @($TenantFilter)
+            } else {
+                Write-LogMessage -API 'Tests' -tenant $TenantFilter -message 'Tenant has no data in database. Skipping tests.' -sev Info
+                @()
+            }
+        }
+
+        if ($AllTenantsList.Count -eq 0) {
+            Write-LogMessage -API 'Tests' -message 'No tenants with data found. Exiting.' -sev Info
+            return
+        }
+
+        # Build batch: all tests for all tenants
+        $Batch = foreach ($Tenant in $AllTenantsList) {
+            foreach ($Test in $AllTests) {
+                @{
+                    FunctionName = 'CIPPTest'
+                    TenantFilter = $Tenant
+                    TestId       = $Test
+                }
+            }
+        }
+
+        Write-Information "Built batch of $($Batch.Count) test activities ($($AllTests.Count) tests × $($AllTenantsList.Count) tenants)"
+
+        $InputObject = [PSCustomObject]@{
+            OrchestratorName = 'TestsRun'
+            Batch            = @($Batch)
+            SkipLog          = $true
+        }
+
+        $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 5 -Compress)
+        Write-Information "Started tests orchestration with ID = '$InstanceId'"
+
+        return @{
+            InstanceId = $InstanceId
+            Message    = "Tests orchestration started: $($AllTests.Count) tests for $($AllTenantsList.Count) tenants"
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -message "Failed to start tests orchestration: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        throw $ErrorMessage
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1
new file mode 100644
index 000000000000..7492a7c15abc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1	
@@ -0,0 +1,30 @@
+function Push-CIPPTest {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    param(
+        $Item
+    )
+
+    $TenantFilter = $Item.TenantFilter
+    $TestId = $Item.TestId
+
+    Write-Information "Running test $TestId for tenant $TenantFilter"
+
+    try {
+        $FunctionName = "Invoke-CippTest$TestId"
+
+        if (-not (Get-Command $FunctionName -ErrorAction SilentlyContinue)) {
+            Write-LogMessage -API 'Tests' -tenant $TenantFilter -message "Test function not found: $FunctionName" -sev Error
+            return
+        }
+
+        Write-Information "Executing $FunctionName for $TenantFilter"
+        & $FunctionName -Tenant $TenantFilter
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $TenantFilter -message "Failed to run test $TestId $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsRun.ps1 b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsRun.ps1
new file mode 100644
index 000000000000..7bea0f014457
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsRun.ps1	
@@ -0,0 +1,36 @@
+function Push-CIPPTestsRun {
+    <#
+    .SYNOPSIS
+        PostExecution function to run tests after data collection completes
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    param($Item)
+
+    try {
+        $TenantFilter = $Item.Parameters.TenantFilter
+        Write-Information "PostExecution: Starting tests for tenant: $TenantFilter after data collection completed"
+        Write-LogMessage -API 'Tests' -tenant $TenantFilter -message 'Starting test run after data collection' -sev Info
+
+        # Call the test run function
+        $Result = Invoke-CIPPTestsRun -TenantFilter $TenantFilter
+
+        Write-LogMessage -API 'Tests' -tenant $TenantFilter -message "Test run started. Instance ID: $($Result.InstanceId)" -sev Info
+        Write-Information "PostExecution: Tests started with Instance ID: $($Result.InstanceId)"
+
+        return @{
+            Success    = $true
+            InstanceId = $Result.InstanceId
+            Message    = $Result.Message
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $TenantFilter -message "Failed to start test run: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Write-Warning "PostExecution: Error starting tests - $($ErrorMessage.NormalizedError)"
+
+        return @{
+            Success = $false
+            Error   = $ErrorMessage.NormalizedError
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecAppInsightsQuery.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecAppInsightsQuery.ps1
index 23868530621f..298d948ba283 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecAppInsightsQuery.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecAppInsightsQuery.ps1	
@@ -24,13 +24,12 @@ function Invoke-ExecAppInsightsQuery {
     try {
         $LogData = Get-ApplicationInsightsQuery -Query $Query
 
-        $Body = @{
+        $Body = ConvertTo-Json -Depth 10 -Compress -InputObject @{
             Results  = @($LogData)
             Metadata = @{
                 Query = $Query
             }
-        } | ConvertTo-Json -Depth 10 -Compress
-
+        }
         return [HttpResponseContext]@{
             StatusCode = [HttpStatusCode]::OK
             Body       = $Body
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCache.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCache.ps1
new file mode 100644
index 000000000000..92e4249af55b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCIPPDBCache.ps1	
@@ -0,0 +1,92 @@
+function Invoke-ExecCIPPDBCache {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.Core.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $TenantFilter = $Request.Query.TenantFilter
+    $Name = $Request.Query.Name
+
+    Write-Information "ExecCIPPDBCache called with Name: '$Name', TenantFilter: '$TenantFilter'"
+
+    try {
+        if ([string]::IsNullOrEmpty($Name)) {
+            throw 'Name parameter is required'
+        }
+
+        if ([string]::IsNullOrEmpty($TenantFilter)) {
+            throw 'TenantFilter parameter is required'
+        }
+
+        # Validate the function exists
+        $FunctionName = "Set-CIPPDBCache$Name"
+        $Function = Get-Command -Name $FunctionName -ErrorAction SilentlyContinue
+        if (-not $Function) {
+            throw "Cache function '$FunctionName' not found"
+        }
+
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Starting CIPP DB cache for $Name" -sev Info
+
+        # Handle AllTenants - create a batch for each tenant
+        if ($TenantFilter -eq 'AllTenants') {
+            $TenantList = Get-Tenants -IncludeErrors
+            $Batch = $TenantList | ForEach-Object {
+                [PSCustomObject]@{
+                    FunctionName = 'ExecCIPPDBCache'
+                    Name         = $Name
+                    TenantFilter = $_.defaultDomainName
+                }
+            }
+            
+            $InputObject = [PSCustomObject]@{
+                Batch            = @($Batch)
+                OrchestratorName = "CIPPDBCache_${Name}_AllTenants"
+                SkipLog          = $false
+            }
+            
+            Write-LogMessage -API $APIName -tenant $TenantFilter -message "Starting CIPP DB cache for $Name across $($TenantList.Count) tenants" -sev Info
+        } else {
+            # Single tenant
+            $InputObject = [PSCustomObject]@{
+                Batch            = @([PSCustomObject]@{
+                        FunctionName = 'ExecCIPPDBCache'
+                        Name         = $Name
+                        TenantFilter = $TenantFilter
+                    })
+                OrchestratorName = "CIPPDBCache_${Name}_$TenantFilter"
+                SkipLog          = $false
+            }
+        }
+
+        $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Compress -Depth 5)
+
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Started CIPP DB cache orchestrator for $Name with instance ID: $InstanceId" -sev Info
+
+        $Body = [PSCustomObject]@{
+            Results  = "Successfully started cache operation for $Name$(if ($TenantFilter -eq 'AllTenants') { ' for all tenants' } else { " on tenant $TenantFilter" })"
+            Metadata = @{
+                Name       = $Name
+                Tenant     = $TenantFilter
+                InstanceId = $InstanceId
+            }
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to start CIPP DB cache for $Name : $ErrorMessage" -sev Error
+        $Body = [PSCustomObject]@{
+            Results = "Failed to start cache operation: $ErrorMessage"
+        }
+        $StatusCode = [HttpStatusCode]::BadRequest
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1
index d4cdfab364b2..0142225044e0 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecListBackup.ps1	
@@ -31,11 +31,22 @@ function Invoke-ExecListBackup {
                     Items        = $properties.Name
                 }
             } else {
+                # Prefer stored indicator (BackupIsBlob) to avoid reading Backup field
+                $isBlob = $false
+                if ($null -ne $item.PSObject.Properties['BackupIsBlob']) {
+                    try { $isBlob = [bool]$item.BackupIsBlob } catch { $isBlob = $false }
+                } else {
+                    # Fallback heuristic for legacy rows if property missing
+                    if ($null -ne $item.PSObject.Properties['Backup']) {
+                        $b = $item.Backup
+                        if ($b -is [string] -and ($b -like 'https://*' -or $b -like 'http://*')) { $isBlob = $true }
+                    }
+                }
                 [PSCustomObject]@{
                     BackupName = $item.RowKey
                     Timestamp  = $item.Timestamp
+                    Source     = if ($isBlob) { 'blob' } else { 'table' }
                 }
-
             }
         }
         $Result = $Processed | Sort-Object Timestamp -Descending
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1
index 4898e5bb8def..e0cc80a3bc9a 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1	
@@ -39,9 +39,9 @@ function Invoke-ExecSetPackageTag {
                 GUID         = "$GUID"
                 Package      = $PackageValue
                 SHA          = $Template.SHA ?? $null
+                Source       = $Template.Source ?? $null
             }
 
-
             Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
 
             if ($Remove -eq $true) {
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-AddScheduledItem.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-AddScheduledItem.ps1
index 17f35f5adf12..18aecda3ab90 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-AddScheduledItem.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-AddScheduledItem.ps1	
@@ -13,6 +13,8 @@ function Invoke-AddScheduledItem {
         $hidden = $true
     }
 
+    $DisallowDuplicateName = $Request.Query.DisallowDuplicateName ?? $Request.Body.DisallowDuplicateName
+
     if ($Request.Body.RunNow -eq $true) {
         try {
             $Table = Get-CIPPTable -TableName 'ScheduledTasks'
@@ -32,8 +34,8 @@ function Invoke-AddScheduledItem {
         $ScheduledTask = @{
             Task                  = $Request.Body
             Headers               = $Request.Headers
-            hidden                = $hidden
-            DisallowDuplicateName = $Request.Query.DisallowDuplicateName
+            Hidden                = $hidden
+            DisallowDuplicateName = $DisallowDuplicateName
             DesiredStartTime      = $Request.Body.DesiredStartTime
         }
         $Result = Add-CIPPScheduledTask @ScheduledTask
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1
index edc9691e2c61..37ae04aa3a21 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1	
@@ -22,9 +22,9 @@ function Invoke-ListScheduledItems {
         $SearchTitle = $Request.query.SearchTitle ?? $Request.body.SearchTitle
 
         if ($ShowHidden -eq $true) {
-            $ScheduledItemFilter.Add('Hidden eq true')
+            $ScheduledItemFilter.Add("(Hidden eq true or Hidden eq 'True')")
         } else {
-            $ScheduledItemFilter.Add('Hidden eq false')
+            $ScheduledItemFilter.Add("(Hidden eq false or Hidden eq 'False')")
         }
 
         if ($Name) {
@@ -43,6 +43,7 @@ function Invoke-ListScheduledItems {
         $HiddenTasks = $true
     }
     $Tasks = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+    Write-Information "Retrieved $($Tasks.Count) scheduled tasks from storage."
     if ($Type) {
         $Tasks = $Tasks | Where-Object { $_.command -eq $Type }
     }
@@ -58,8 +59,12 @@ function Invoke-ListScheduledItems {
         $AllowedTenantDomains = $TenantList | Where-Object -Property customerId -In $AllowedTenants | Select-Object -ExpandProperty defaultDomainName
         $Tasks = $Tasks | Where-Object -Property Tenant -In $AllowedTenantDomains
     }
-    $ScheduledTasks = foreach ($Task in $tasks) {
+
+    Write-Information "Found $($Tasks.Count) scheduled tasks after filtering and access check."
+
+    $ScheduledTasks = foreach ($Task in $Tasks) {
         if (!$Task.Tenant -or !$Task.Command) {
+            Write-Information "Skipping invalid scheduled task entry: $($Task.RowKey)"
             continue
         }
 
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1
index 043b12fea790..699550f4cf69 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBackendURLs.ps1	
@@ -21,13 +21,13 @@ function Invoke-ExecBackendURLs {
     }
 
     $results = [PSCustomObject]@{
-        ResourceGroup      = "https://portal.azure.com/#@Go/resource/subscriptions/$Subscription/resourceGroups/$RGName/overview"
-        KeyVault           = "https://portal.azure.com/#@Go/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.KeyVault/vaults/$($env:WEBSITE_SITE_NAME)/secrets"
-        FunctionApp        = "https://portal.azure.com/#@Go/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($env:WEBSITE_SITE_NAME)/appServices"
-        FunctionConfig     = "https://portal.azure.com/#@Go/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($env:WEBSITE_SITE_NAME)/configuration"
-        FunctionDeployment = "https://portal.azure.com/#@Go/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($env:WEBSITE_SITE_NAME)/vstscd"
-        SWADomains         = "https://portal.azure.com/#@Go/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/staticSites/$SWAName/customDomains"
-        SWARoles           = "https://portal.azure.com/#@Go/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/staticSites/$SWAName/roleManagement"
+        ResourceGroup      = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/overview"
+        KeyVault           = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.KeyVault/vaults/$($env:WEBSITE_SITE_NAME)/secrets"
+        FunctionApp        = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($env:WEBSITE_SITE_NAME)/appServices"
+        FunctionConfig     = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($env:WEBSITE_SITE_NAME)/configuration"
+        FunctionDeployment = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/sites/$($env:WEBSITE_SITE_NAME)/vstscd"
+        SWADomains         = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/staticSites/$SWAName/customDomains"
+        SWARoles           = "https://portal.azure.com/#@/resource/subscriptions/$Subscription/resourceGroups/$RGName/providers/Microsoft.Web/staticSites/$SWAName/roleManagement"
         Subscription       = $Subscription
         RGName             = $RGName
         FunctionName       = $env:WEBSITE_SITE_NAME
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1
index efd32dc5b5d4..dc3a91b75e05 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCustomRole.ps1	
@@ -10,6 +10,7 @@ function Invoke-ExecCustomRole {
 
     $Table = Get-CippTable -tablename 'CustomRoles'
     $AccessRoleGroupTable = Get-CippTable -tablename 'AccessRoleGroups'
+    $AccessIPRangeTable = Get-CippTable -tablename 'AccessIPRanges'
     $Action = $Request.Query.Action ?? $Request.Body.Action
 
     $CIPPCore = (Get-Module -Name CIPPCore).ModuleBase
@@ -33,6 +34,20 @@ function Invoke-ExecCustomRole {
             try {
                 $Results = [System.Collections.Generic.List[string]]::new()
                 Write-LogMessage -headers $Request.Headers -API 'ExecCustomRole' -message "Saved custom role $($Request.Body.RoleName)" -Sev 'Info'
+
+                # Process IP Range if provided (but not for superadmin to prevent lockout)
+                if ($Request.Body.IpRange -and $Request.Body.RoleName -ne 'superadmin') {
+                    $IpRange = [System.Collections.Generic.List[string]]::new()
+                    $regexPattern = '^(?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}(?:/\d{1,2})?|(?:[0-9A-Fa-f]{1,4}:){1,7}[0-9A-Fa-f]{1,4}(?:/\d{1,3})?)$'
+                    foreach ($IP in @($Request.Body.IpRange)) {
+                        if ($IP -match $regexPattern) {
+                            $IpRange.Add($IP)
+                        }
+                    }
+                } else {
+                    $IpRange = @()
+                }
+
                 if ($Request.Body.RoleName -notin $DefaultRoles.PSObject.Properties.Name) {
                     $Role = @{
                         'PartitionKey'     = 'CustomRoles'
@@ -45,6 +60,28 @@ function Invoke-ExecCustomRole {
                     Add-CIPPAzDataTableEntity @Table -Entity $Role -Force | Out-Null
                     $Results.Add("Custom role $($Request.Body.RoleName) saved")
                 }
+                if ($Request.Body.RoleName -eq 'superadmin' -and $Request.Body.IpRange) {
+                    $Results.Add('Note: IP restrictions are not allowed on the superadmin role to prevent lockout issues.')
+                }
+                # Store IP ranges in separate table (works for both custom and default roles)
+                if ($IpRange.Count -gt 0 -and $Request.Body.RoleName -ne 'superadmin') {
+                    $IPRangeEntity = @{
+                        'PartitionKey' = 'AccessIPRanges'
+                        'RowKey'       = "$($Request.Body.RoleName.ToLower())"
+                        'IPRanges'     = "$(@($IpRange) | ConvertTo-Json -Compress)"
+                    }
+                    Add-CIPPAzDataTableEntity @AccessIPRangeTable -Entity $IPRangeEntity -Force | Out-Null
+                    $Results.Add("IP ranges configured for '$($Request.Body.RoleName)' role.")
+                } else {
+                    # Remove IP ranges if none provided or role is superadmin
+                    $ExistingIPRange = Get-CIPPAzDataTableEntity @AccessIPRangeTable -Filter "RowKey eq '$($Request.Body.RoleName.ToLower())'"
+                    if ($ExistingIPRange) {
+                        Remove-AzDataTableEntity -Force @AccessIPRangeTable -Entity $ExistingIPRange
+                        if ($Request.Body.RoleName -ne 'superadmin') {
+                            $Results.Add("IP ranges removed from '$($Request.Body.RoleName)' role.")
+                        }
+                    }
+                }
                 if ($Request.Body.EntraGroup) {
                     $RoleGroup = @{
                         'PartitionKey' = 'AccessRoleGroups'
@@ -98,6 +135,16 @@ function Invoke-ExecCustomRole {
                     'BlockedEndpoints' = $ExistingRole.BlockedEndpoints
                 }
                 Add-CIPPAzDataTableEntity @Table -Entity $NewRole -Force | Out-Null
+                # Clone IP ranges if they exist
+                $ExistingIPRange = Get-CIPPAzDataTableEntity @AccessIPRangeTable -Filter "RowKey eq '$($Request.Body.RoleName.ToLower())'"
+                if ($ExistingIPRange) {
+                    $NewIPRangeEntity = @{
+                        'PartitionKey' = 'AccessIPRanges'
+                        'RowKey'       = "$($Request.Body.NewRoleName.ToLower())"
+                        'IPRanges'     = $ExistingIPRange.IPRanges
+                    }
+                    Add-CIPPAzDataTableEntity @AccessIPRangeTable -Entity $NewIPRangeEntity -Force | Out-Null
+                }
                 $Body = @{Results = "Custom role '$($Request.Body.NewRoleName)' cloned from '$($Request.Body.RoleName)'" }
                 Write-LogMessage -headers $Request.Headers -API 'ExecCustomRole' -message "Cloned custom role $($Request.Body.RoleName) to $($Request.Body.NewRoleName)" -Sev 'Info'
             } catch {
@@ -114,6 +161,10 @@ function Invoke-ExecCustomRole {
             if ($AccessRoleGroup) {
                 Remove-AzDataTableEntity -Force @AccessRoleGroupTable -Entity $AccessRoleGroup
             }
+            $AccessIPRange = Get-CIPPAzDataTableEntity @AccessIPRangeTable -Filter "PartitionKey eq 'AccessIPRanges' and RowKey eq '$($Request.Body.RoleName)'"
+            if ($AccessIPRange) {
+                Remove-AzDataTableEntity -Force @AccessIPRangeTable -Entity $AccessIPRange
+            }
             $Body = @{Results = 'Custom role deleted' }
             Write-LogMessage -headers $Request.Headers -API 'ExecCustomRole' -message "Deleted custom role $($Request.Body.RoleName)" -Sev 'Info'
         }
@@ -129,6 +180,7 @@ function Invoke-ExecCustomRole {
         default {
             $Body = Get-CIPPAzDataTableEntity @Table
             $EntraRoleGroups = Get-CIPPAzDataTableEntity @AccessRoleGroupTable
+            $AccessIPRanges = Get-CIPPAzDataTableEntity @AccessIPRangeTable
             if (!$Body) {
                 $Body = @(
                     @{
@@ -175,6 +227,18 @@ function Invoke-ExecCustomRole {
 
                         $Role | Add-Member -NotePropertyName EntraGroup -NotePropertyValue $EntraGroup -Force
                     }
+                    # Load IP ranges from separate table
+                    $IPRangeEntity = $AccessIPRanges | Where-Object -Property RowKey -EQ $Role.RowKey
+                    if ($IPRangeEntity) {
+                        try {
+                            $IPRanges = @($IPRangeEntity.IPRanges | ConvertFrom-Json)
+                        } catch {
+                            $IPRanges = @()
+                        }
+                        $Role | Add-Member -NotePropertyName IPRange -NotePropertyValue $IPRanges -Force
+                    } else {
+                        $Role | Add-Member -NotePropertyName IPRange -NotePropertyValue @() -Force
+                    }
                     $Role
                 }
                 $DefaultRoles = foreach ($DefaultRole in $DefaultRoles.PSObject.Properties.Name) {
@@ -189,6 +253,18 @@ function Invoke-ExecCustomRole {
                     if ($EntraRoleGroup) {
                         $Role.EntraGroup = $EntraRoleGroups | Where-Object -Property RowKey -EQ $Role.RowKey | Select-Object @{Name = 'label'; Expression = { $_.GroupName } }, @{Name = 'value'; Expression = { $_.GroupId } }
                     }
+                    # Load IP ranges from separate table
+                    $IPRangeEntity = $AccessIPRanges | Where-Object -Property RowKey -EQ $DefaultRole
+                    if ($IPRangeEntity) {
+                        try {
+                            $IPRanges = @($IPRangeEntity.IPRanges | ConvertFrom-Json)
+                        } catch {
+                            $IPRanges = @()
+                        }
+                        $Role.IPRange = $IPRanges
+                    } else {
+                        $Role.IPRange = @()
+                    }
                     $Role
                 }
                 $Body = @($DefaultRoles + $CustomRoles)
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1
index c208252b3dca..facaa423a70a 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExchangeRoleRepair.ps1	
@@ -89,7 +89,7 @@ function Invoke-ExecExchangeRoleRepair {
         }
     }
 
-    Push-OutputBinding -Name 'Response' -Value ([HttpResponseContext]@{
+    returns ([HttpResponseContext]@{
             StatusCode = [System.Net.HttpStatusCode]::OK
             Body       = $Results
         })
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1
new file mode 100644
index 000000000000..416c118bd238
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecJITAdminSettings.ps1	
@@ -0,0 +1,94 @@
+function Invoke-ExecJITAdminSettings {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.AppSettings.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $StatusCode = [HttpStatusCode]::OK
+
+    try {
+        $Table = Get-CIPPTable -TableName Config
+        $Filter = "PartitionKey eq 'JITAdminSettings' and RowKey eq 'JITAdminSettings'"
+        $JITAdminConfig = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+
+        if (-not $JITAdminConfig) {
+            $JITAdminConfig = @{
+                PartitionKey = 'JITAdminSettings'
+                RowKey       = 'JITAdminSettings'
+                MaxDuration  = $null  # null means no limit
+            }
+        }
+
+        $Action = if ($Request.Body.Action) { $Request.Body.Action } else { $Request.Query.Action }
+
+        $Results = switch ($Action) {
+            'Get' {
+                @{
+                    MaxDuration = $JITAdminConfig.MaxDuration
+                }
+            }
+            'Set' {
+                $MaxDuration = $Request.Body.MaxDuration.value
+                Write-Host "MAx dur: $($MaxDuration)"
+                # Validate ISO 8601 duration format if provided
+                if (![string]::IsNullOrWhiteSpace($MaxDuration)) {
+                    try {
+                        # Test if it's a valid ISO 8601 duration
+                        $null = [System.Xml.XmlConvert]::ToTimeSpan($MaxDuration)
+                        $JITAdminConfig | Add-Member -NotePropertyName MaxDuration -NotePropertyValue $MaxDuration -Force
+                    } catch {
+                        $StatusCode = [HttpStatusCode]::BadRequest
+                        @{
+                            Results = 'Error: Invalid ISO 8601 duration format. Expected format like PT4H, P1D, P4W, etc.'
+                        }
+                        break
+                    }
+                } else {
+                    # Empty or null means no limit
+                    $JITAdminConfig.MaxDuration = $null
+                }
+
+                $JITAdminConfig.PartitionKey = 'JITAdminSettings'
+                $JITAdminConfig.RowKey = 'JITAdminSettings'
+
+                Add-CIPPAzDataTableEntity @Table -Entity $JITAdminConfig -Force | Out-Null
+
+                $Message = if ($JITAdminConfig.MaxDuration) {
+                    "Successfully set JIT Admin maximum duration to $($JITAdminConfig.MaxDuration)"
+                } else {
+                    'Successfully removed JIT Admin maximum duration limit'
+                }
+
+                Write-LogMessage -headers $Headers -API $APIName -message $Message -Sev 'Info'
+
+                @{
+                    Results = $Message
+                }
+            }
+            default {
+                $StatusCode = [HttpStatusCode]::BadRequest
+                @{
+                    Results = 'Error: Invalid action. Use Get or Set.'
+                }
+            }
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $StatusCode = [HttpStatusCode]::InternalServerError
+        $Results = @{
+            Results = "Error: $($ErrorMessage.NormalizedError)"
+        }
+        Write-LogMessage -headers $Headers -API $APIName -message "Failed to process JIT Admin settings: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Results
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1
index 37f08dcd22de..61a133046e41 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1	
@@ -12,13 +12,26 @@ function Invoke-ExecRestoreBackup {
     try {
 
         if ($Request.Body.BackupName -like 'CippBackup_*') {
-            $Table = Get-CippTable -tablename 'CIPPBackup'
-            $Backup = Get-CippAzDataTableEntity @Table -Filter "RowKey eq '$($Request.Body.BackupName)' or OriginalEntityId eq '$($Request.Body.BackupName)'"
+            # Use Get-CIPPBackup which already handles fetching from blob storage
+            $Backup = Get-CIPPBackup -Type 'CIPP' -Name $Request.Body.BackupName
             if ($Backup) {
-                $BackupData = $Backup.Backup | ConvertFrom-Json -ErrorAction SilentlyContinue | Select-Object * -ExcludeProperty ETag, Timestamp
+                $raw = $Backup.Backup
+                $BackupData = $null
+
+                # Get-CIPPBackup already fetches blob content, so raw should be JSON string
+                try {
+                    if ($raw -is [string]) {
+                        $BackupData = $raw | ConvertFrom-Json -ErrorAction Stop
+                    } else {
+                        $BackupData = $raw | Select-Object * -ExcludeProperty ETag, Timestamp
+                    }
+                } catch {
+                    throw "Failed to parse backup JSON: $($_.Exception.Message)"
+                }
+
                 $BackupData | ForEach-Object {
                     $Table = Get-CippTable -tablename $_.table
-                    $ht2 = @{ }
+                    $ht2 = @{}
                     $_.psobject.properties | ForEach-Object { $ht2[$_.Name] = [string]$_.Value }
                     $Table.Entity = $ht2
                     Add-CIPPAzDataTableEntity @Table -Force
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1
index 0e33e92067e3..73b1a1bce23b 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1	
@@ -45,7 +45,7 @@ function Invoke-ExecTenantGroup {
                 }
                 $GroupEntity | Add-Member -NotePropertyName 'GroupType' -NotePropertyValue $groupType -Force
                 if ($groupType -eq 'dynamic' -and $dynamicRules) {
-                    $GroupEntity.DynamicRules = "$($dynamicRules | ConvertTo-Json -Depth 100 -Compress)"
+                    $GroupEntity | Add-Member -NotePropertyName 'DynamicRules' -NotePropertyValue "$($dynamicRules | ConvertTo-Json -Depth 100 -Compress)" -Force
                     $GroupEntity | Add-Member -NotePropertyName 'RuleLogic' -NotePropertyValue $ruleLogic -Force
                 } else {
                     $GroupEntity | Add-Member -NotePropertyName 'RuleLogic' -NotePropertyValue $null -Force
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1
index 0fac4036a55f..08e84177482a 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCustomRole.ps1	
@@ -14,12 +14,26 @@ function Invoke-ListCustomRole {
     $AccessRoleGroupTable = Get-CippTable -tablename 'AccessRoleGroups'
     $RoleGroups = Get-CIPPAzDataTableEntity @AccessRoleGroupTable
 
+    $AccessIPRangeTable = Get-CippTable -tablename 'AccessIPRanges'
+    $AccessIPRanges = Get-CIPPAzDataTableEntity @AccessIPRangeTable
+
     $TenantList = Get-Tenants -IncludeErrors
 
     $RoleList = [System.Collections.Generic.List[pscustomobject]]::new()
     foreach ($Role in $DefaultRoles) {
         $RoleGroup = $RoleGroups | Where-Object -Property RowKey -EQ $Role
 
+        $IPRangeEntity = $AccessIPRanges | Where-Object -Property RowKey -EQ $Role
+        if ($IPRangeEntity) {
+            try {
+                $IPRanges = @($IPRangeEntity.IPRanges | ConvertFrom-Json)
+            } catch {
+                $IPRanges = @()
+            }
+        } else {
+            $IPRanges = @()
+        }
+
         $RoleList.Add([pscustomobject]@{
                 RoleName       = $Role
                 Type           = 'Built-In'
@@ -28,6 +42,7 @@ function Invoke-ListCustomRole {
                 BlockedTenants = @()
                 EntraGroup     = $RoleGroup.GroupName ?? $null
                 EntraGroupId   = $RoleGroup.GroupId ?? $null
+                IPRange        = $IPRanges
             })
     }
     foreach ($Role in $CustomRoles) {
@@ -129,3 +144,4 @@ function Invoke-ListCustomRole {
             Body       = ConvertTo-Json -InputObject $Body -Depth 5
         })
 }
+
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListTenantGroups.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListTenantGroups.ps1
index 7de5c13c4ad9..4aae7a0858df 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListTenantGroups.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListTenantGroups.ps1	
@@ -11,7 +11,7 @@ function Invoke-ListTenantGroups {
     param($Request, $TriggerMetadata)
 
     $groupFilter = $Request.Query.groupId ?? $Request.Body.groupId
-    $TenantGroups = (Get-TenantGroups -GroupId $groupFilter) ?? @()
+    $TenantGroups = (Get-TenantGroups -GroupId $groupFilter -SkipCache) ?? @()
     $Body = @{ Results = @($TenantGroups) }
 
     return ([HttpResponseContext]@{
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1
index 6945b4881e7b..95b4a7de57bb 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1	
@@ -1,4 +1,4 @@
-Function Invoke-ListmailboxPermissions {
+function Invoke-ListmailboxPermissions {
     <#
     .FUNCTIONALITY
         Entrypoint
@@ -10,8 +10,31 @@ Function Invoke-ListmailboxPermissions {
     # Interact with query parameters or the body of the request.
     $TenantFilter = $Request.Query.tenantFilter
     $UserID = $Request.Query.userId
+    $UseReportDB = $Request.Query.UseReportDB
+    $ByUser = $Request.Query.ByUser
 
     try {
+        # If UseReportDB is specified and no specific UserID, retrieve from report database
+        if ($UseReportDB -eq 'true' -and -not $UserID) {
+
+            # Call the report function with proper parameters
+            $ReportParams = @{
+                TenantFilter = $TenantFilter
+            }
+            if ($ByUser -eq 'true') {
+                $ReportParams.ByUser = $true
+            }
+
+            $GraphRequest = Get-CIPPMailboxPermissionReport @ReportParams
+            $StatusCode = [HttpStatusCode]::OK
+
+            return ([HttpResponseContext]@{
+                    StatusCode = $StatusCode
+                    Body       = @($GraphRequest)
+                })
+        }
+
+        # Original live query logic for specific user
         $Requests = @(
             @{
                 CmdletInput = @{
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1
index 1249f3f14a6c..a0e307c1cba8 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListSharedMailboxAccountEnabled.ps1	
@@ -19,7 +19,7 @@ function Invoke-ListSharedMailboxAccountEnabled {
             # Match the User
             $User = $AllUsersInfo | Where-Object { $_.userPrincipalName -eq $SharedMailbox.userPrincipalName } | Select-Object -First 1
 
-            if ($User) {
+            if ($User.accountEnabled) {
                 # Return all shared mailboxes with license information
                 [PSCustomObject]@{
                     UserPrincipalName     = $User.userPrincipalName
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1
index 55e74c8693e0..bdbc7f7dba1f 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1	
@@ -13,7 +13,7 @@ function Invoke-AddMSPApp {
 
 
     $RMMApp = $Request.Body
-    $AssignTo = $Request.Body.AssignTo
+    $AssignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
     $intuneBody = Get-Content "AddMSPApp\$($RMMApp.RMMName.value).app.json" | ConvertFrom-Json
     $intuneBody.displayName = $RMMApp.DisplayName
 
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1
index 4395e899a8fe..97d65b678542 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1	
@@ -13,7 +13,7 @@ function Invoke-AddOfficeApp {
     $Headers = $Request.Headers
     $APIName = $Request.Params.CIPPEndpoint
     if ('AllTenants' -in $Tenants) { $Tenants = (Get-Tenants).defaultDomainName }
-    $AssignTo = if ($Request.Body.AssignTo -ne 'on') { $Request.Body.AssignTo }
+    $AssignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
 
     $Results = foreach ($Tenant in $Tenants) {
         try {
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1
index 6b34aaaea5d4..af6eb44c1be7 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1	
@@ -1,4 +1,4 @@
-Function Invoke-AddStoreApp {
+function Invoke-AddStoreApp {
     <#
     .FUNCTIONALITY
         Entrypoint
@@ -13,7 +13,7 @@ Function Invoke-AddStoreApp {
 
 
     $WinGetApp = $Request.Body
-    $assignTo = $Request.body.AssignTo
+    $assignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
 
     if ($ChocoApp.InstallAsSystem) { 'system' } else { 'user' }
     $WinGetData = [ordered]@{
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecDevicePasscodeAction.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecDevicePasscodeAction.ps1
index 2207fa5761b0..cf0da9778d60 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecDevicePasscodeAction.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecDevicePasscodeAction.ps1	
@@ -46,7 +46,7 @@ function Invoke-ExecDevicePasscodeAction {
         $Results = $Result
     }
 
-    Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
+    return ([HttpResponseContext]@{
             StatusCode = $StatusCode
             Body       = @{Results = $Results }
         })
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1
index 7fc2af495e1b..ef6b59fec416 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1	
@@ -25,7 +25,7 @@
             @{
                 id     = 'ManagedAppPolicies'
                 method = 'GET'
-                url    = '/deviceAppManagement/managedAppPolicies?$expand=assignments&$orderby=displayName'
+                url    = '/deviceAppManagement/managedAppPolicies?$orderby=displayName'
             }
             @{
                 id     = 'MobileAppConfigurations'
@@ -41,60 +41,58 @@
 
         $GraphRequest = [System.Collections.Generic.List[object]]::new()
 
-        # Process Managed App Policies - these need separate assignment lookups
+        # Process Managed App Policies - these need separate assignment lookups as the ManagedAppPolicies endpoint does not support $expand
         $ManagedAppPolicies = ($BulkResults | Where-Object { $_.id -eq 'ManagedAppPolicies' }).body.value
         if ($ManagedAppPolicies) {
-            # Build bulk requests for assignments of policies that support them
-            $AssignmentRequests = [System.Collections.Generic.List[object]]::new()
-            foreach ($Policy in $ManagedAppPolicies) {
-                # Only certain policy types support assignments endpoint
-                $odataType = $Policy.'@odata.type'
-                if ($odataType -match 'androidManagedAppProtection|iosManagedAppProtection|windowsManagedAppProtection|targetedManagedAppConfiguration') {
-                    $urlSegment = switch -Wildcard ($odataType) {
-                        '*androidManagedAppProtection*' { 'androidManagedAppProtections' }
-                        '*iosManagedAppProtection*' { 'iosManagedAppProtections' }
-                        '*windowsManagedAppProtection*' { 'windowsManagedAppProtections' }
-                        '*targetedManagedAppConfiguration*' { 'targetedManagedAppConfigurations' }
-                    }
-                    if ($urlSegment) {
-                        $AssignmentRequests.Add(@{
-                                id     = $Policy.id
-                                method = 'GET'
-                                url    = "/deviceAppManagement/$urlSegment('$($Policy.id)')/assignments"
-                            })
+            # Get all @odata.type and deduplicate them
+            $OdataTypes = ($ManagedAppPolicies | Select-Object -ExpandProperty '@odata.type' -Unique) -replace '#microsoft.graph.', ''
+            $ManagedAppPoliciesBulkRequests = foreach ($type in $OdataTypes) {
+                # Translate to URL segments
+                $urlSegment = switch ($type) {
+                    'androidManagedAppProtection' { 'androidManagedAppProtections' }
+                    'iosManagedAppProtection' { 'iosManagedAppProtections' }
+                    'mdmWindowsInformationProtectionPolicy' { 'mdmWindowsInformationProtectionPolicies' }
+                    'windowsManagedAppProtection' { 'windowsManagedAppProtections' }
+                    'targetedManagedAppConfiguration' { 'targetedManagedAppConfigurations' }
+                    default { $null }
+                }
+                Write-Information "Type: $type => URL Segment: $urlSegment"
+                if ($urlSegment) {
+                    @{
+                        id     = $type
+                        method = 'GET'
+                        url    = "/deviceAppManagement/${urlSegment}?`$expand=assignments&`$orderby=displayName"
                     }
                 }
             }
 
-            # Fetch assignments in bulk if we have any
-            $AssignmentResults = @{}
-            if ($AssignmentRequests.Count -gt 0) {
-                $AssignmentBulkResults = New-GraphBulkRequest -Requests $AssignmentRequests -tenantid $TenantFilter
-                foreach ($result in $AssignmentBulkResults) {
-                    if ($result.body.value) {
-                        $AssignmentResults[$result.id] = $result.body.value
-                    }
-                }
+            $ManagedAppPoliciesBulkResults = New-GraphBulkRequest -Requests $ManagedAppPoliciesBulkRequests -tenantid $TenantFilter
+            # Do this horriblenes as a workaround, as the results dont return with a odata.type property
+            $ManagedAppPolicies = $ManagedAppPoliciesBulkResults | ForEach-Object {
+                $URLName = $_.id
+                $_.body.value | Add-Member -NotePropertyName 'URLName' -NotePropertyValue $URLName -Force
+                $_.body.value
             }
 
+
+
             foreach ($Policy in $ManagedAppPolicies) {
-                $policyType = switch -Wildcard ($Policy.'@odata.type') {
-                    '*androidManagedAppProtection*' { 'Android App Protection' }
-                    '*iosManagedAppProtection*' { 'iOS App Protection' }
-                    '*windowsManagedAppProtection*' { 'Windows App Protection' }
-                    '*mdmWindowsInformationProtectionPolicy*' { 'Windows Information Protection (MDM)' }
-                    '*windowsInformationProtectionPolicy*' { 'Windows Information Protection' }
-                    '*targetedManagedAppConfiguration*' { 'App Configuration (MAM)' }
-                    '*defaultManagedAppProtection*' { 'Default App Protection' }
+                $policyType = switch ($Policy.'URLName') {
+                    'androidManagedAppProtection' { 'Android App Protection'; break }
+                    'iosManagedAppProtection' { 'iOS App Protection'; break }
+                    'windowsManagedAppProtection' { 'Windows App Protection'; break }
+                    'mdmWindowsInformationProtectionPolicy' { 'Windows Information Protection (MDM)'; break }
+                    'windowsInformationProtectionPolicy' { 'Windows Information Protection'; break }
+                    'targetedManagedAppConfiguration' { 'App Configuration (MAM)'; break }
+                    'defaultManagedAppProtection' { 'Default App Protection'; break }
                     default { 'App Protection Policy' }
                 }
 
                 # Process assignments
                 $PolicyAssignment = [System.Collections.Generic.List[string]]::new()
                 $PolicyExclude = [System.Collections.Generic.List[string]]::new()
-                $Assignments = $AssignmentResults[$Policy.id]
-                if ($Assignments) {
-                    foreach ($Assignment in $Assignments) {
+                if ($Policy.assignments) {
+                    foreach ($Assignment in $Policy.assignments) {
                         $target = $Assignment.target
                         switch ($target.'@odata.type') {
                             '#microsoft.graph.allDevicesAssignmentTarget' { $PolicyAssignment.Add('All Devices') }
@@ -112,7 +110,7 @@
                 }
 
                 $Policy | Add-Member -NotePropertyName 'PolicyTypeName' -NotePropertyValue $policyType -Force
-                $Policy | Add-Member -NotePropertyName 'URLName' -NotePropertyValue 'managedAppPolicies' -Force
+                # $Policy | Add-Member -NotePropertyName 'URLName' -NotePropertyValue 'managedAppPolicies' -Force
                 $Policy | Add-Member -NotePropertyName 'PolicySource' -NotePropertyValue 'AppProtection' -Force
                 $Policy | Add-Member -NotePropertyName 'PolicyAssignment' -NotePropertyValue ($PolicyAssignment -join ', ') -Force
                 $Policy | Add-Member -NotePropertyName 'PolicyExclude' -NotePropertyValue ($PolicyExclude -join ', ') -Force
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1
index 75f51bee09ae..fc66527eb142 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1	
@@ -15,7 +15,7 @@ function Invoke-ListGroups {
 
     $ExpandMembers = $Request.Query.expandMembers ?? $false
 
-    $SelectString = 'id,createdDateTime,displayName,description,mail,mailEnabled,mailNickname,resourceProvisioningOptions,securityEnabled,visibility,organizationId,onPremisesSamAccountName,membershipRule,groupTypes,onPremisesSyncEnabled,resourceProvisioningOptions,userPrincipalName'
+    $SelectString = 'id,createdDateTime,displayName,description,mail,mailEnabled,mailNickname,resourceProvisioningOptions,securityEnabled,visibility,organizationId,onPremisesSamAccountName,membershipRule,groupTypes,onPremisesSyncEnabled,resourceProvisioningOptions,assignedLicenses,userPrincipalName'
     if ($ExpandMembers -ne $false) {
         $SelectString = '{0}&$expand=members($select=userPrincipalName)' -f $SelectString
     }
@@ -24,7 +24,7 @@ function Invoke-ListGroups {
     $BulkRequestArrayList = [System.Collections.Generic.List[object]]::new()
 
     if ($Request.Query.GroupID) {
-        $SelectString = 'id,createdDateTime,displayName,description,mail,mailEnabled,mailNickname,resourceProvisioningOptions,securityEnabled,visibility,organizationId,onPremisesSamAccountName,membershipRule,groupTypes,userPrincipalName,onPremisesSyncEnabled'
+        $SelectString = 'id,createdDateTime,displayName,description,mail,mailEnabled,mailNickname,resourceProvisioningOptions,securityEnabled,visibility,organizationId,onPremisesSamAccountName,membershipRule,groupTypes,assignedLicenses,userPrincipalName,onPremisesSyncEnabled'
         $BulkRequestArrayList.add(@{
                 id     = 1
                 method = 'GET'
@@ -102,8 +102,8 @@ function Invoke-ListGroups {
                     }
                 },
                 @{Name = 'dynamicGroupBool'; Expression = { if ($_.groupTypes -contains 'DynamicMembership') { $true } else { $false } } }
-                members                = ($RawGraphRequest | Where-Object { $_.id -eq 2 }).body.value
-                owners                 = ($RawGraphRequest | Where-Object { $_.id -eq 3 }).body.value
+                members                = ($RawGraphRequest | Where-Object { $_.id -eq 2 }).body.value | Sort-Object displayName
+                owners                 = ($RawGraphRequest | Where-Object { $_.id -eq 3 }).body.value | Sort-Object displayName
                 allowExternal          = (!$OnlyAllowInternal)
                 sendCopies             = $SendCopies
                 hideFromOutlookClients = if ($GroupType -eq 'Microsoft 365') { $UnifiedGroupInfo.HiddenFromExchangeClientsEnabled } else { $null }
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1
new file mode 100644
index 000000000000..dd2de9d523e0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1	
@@ -0,0 +1,150 @@
+function Invoke-AddJITAdminTemplate {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.Role.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    try {
+        # Extract data from request body
+        $TenantFilter = $Request.Body.tenantFilter
+        $TemplateName = $Request.Body.templateName
+
+        # Validate required fields
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            throw 'tenantFilter is required'
+        }
+        if ([string]::IsNullOrWhiteSpace($TemplateName)) {
+            throw 'templateName is required'
+        }
+
+        Write-LogMessage -headers $Headers -API $APIName -message "Creating JIT Admin template '$TemplateName' for tenant: $TenantFilter" -Sev 'Info'
+
+        # Get user info for audit
+        $UserDetails = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails
+
+        # Check if template name already exists for this tenant
+        $Table = Get-CippTable -tablename 'templates'
+        $ExistingTemplates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'JITAdminTemplate'"
+        $ExistingNames = $ExistingTemplates | ForEach-Object {
+            try {
+                $data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+                if ($data.tenantFilter -eq $TenantFilter -and $data.templateName -eq $TemplateName) {
+                    $data
+                }
+            } catch {}
+        }
+
+        if ($ExistingNames) {
+            throw "A template with name '$TemplateName' already exists for tenant '$TenantFilter'"
+        }
+
+        $DefaultForTenant = [bool]$Request.Body.defaultForTenant
+
+        # If this template is set as default, unset other defaults for this tenant
+        if ($DefaultForTenant) {
+            $ExistingTemplates | ForEach-Object {
+                try {
+                    $row = $_
+                    $data = $row.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+                    if ($data.tenantFilter -eq $TenantFilter -and $data.defaultForTenant -eq $true) {
+                        # Unset the default flag
+                        $data.defaultForTenant = $false
+                        $row.JSON = ($data | ConvertTo-Json -Depth 100 -Compress)
+                        Add-CIPPAzDataTableEntity @Table -Entity $row -Force
+                        Write-LogMessage -headers $Headers -API $APIName -message "Unset default flag for existing template: $($data.templateName)" -Sev 'Info'
+                    }
+                } catch {
+                    Write-LogMessage -headers $Headers -API $APIName -message "Failed to update existing template: $($_.Exception.Message)" -Sev 'Warning'
+                }
+            }
+        }
+
+        # Validate user action fields
+        $DefaultUserAction = $Request.Body.defaultUserAction
+        if ($TenantFilter -eq 'AllTenants' -and $DefaultUserAction -eq 'select') {
+            throw 'defaultUserAction cannot be "select" when tenantFilter is "AllTenants"'
+        }
+
+        # Create template object
+        $TemplateObject = @{
+            tenantFilter                = $TenantFilter
+            templateName                = $TemplateName
+            defaultForTenant            = $DefaultForTenant
+            defaultRoles                = $Request.Body.defaultRoles
+            defaultDuration             = $Request.Body.defaultDuration
+            defaultExpireAction         = $Request.Body.defaultExpireAction
+            defaultNotificationActions  = $Request.Body.defaultNotificationActions
+            generateTAPByDefault        = [bool]$Request.Body.generateTAPByDefault
+            reasonTemplate              = $Request.Body.reasonTemplate
+            createdBy                   = $UserDetails
+            createdDate                 = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+        }
+
+        # Add defaultUserAction if provided
+        if (![string]::IsNullOrWhiteSpace($DefaultUserAction)) {
+            $TemplateObject.defaultUserAction = $DefaultUserAction
+        }
+
+        # Add user detail fields when "create" action is specified
+        if ($DefaultUserAction -eq 'create') {
+            # These fields can be saved for both AllTenants and specific tenant templates
+            if (![string]::IsNullOrWhiteSpace($Request.Body.defaultFirstName)) {
+                $TemplateObject.defaultFirstName = $Request.Body.defaultFirstName
+            }
+            if (![string]::IsNullOrWhiteSpace($Request.Body.defaultLastName)) {
+                $TemplateObject.defaultLastName = $Request.Body.defaultLastName
+            }
+            if (![string]::IsNullOrWhiteSpace($Request.Body.defaultUserName)) {
+                $TemplateObject.defaultUserName = $Request.Body.defaultUserName
+            }
+            
+            # defaultDomain is only saved for specific tenant templates (not AllTenants)
+            if ($TenantFilter -ne 'AllTenants' -and $Request.Body.defaultDomain) {
+                if ($Request.Body.defaultDomain -is [string]) {
+                    if (![string]::IsNullOrWhiteSpace($Request.Body.defaultDomain)) {
+                        $TemplateObject.defaultDomain = $Request.Body.defaultDomain
+                    }
+                } else {
+                    $TemplateObject.defaultDomain = $Request.Body.defaultDomain
+                }
+            }
+        }
+
+        # Generate GUID for the template
+        $GUID = (New-Guid).GUID
+
+        # Convert to JSON
+        $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 100 -Compress
+
+        # Store in table
+        $Table.Force = $true
+        Add-CIPPAzDataTableEntity @Table -Entity @{
+            JSON         = "$JSON"
+            RowKey       = "$GUID"
+            PartitionKey = 'JITAdminTemplate'
+            GUID         = "$GUID"
+        }
+
+        $Result = "Created JIT Admin Template '$($TemplateName)' with GUID $GUID"
+        Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Info'
+        $StatusCode = [HttpStatusCode]::OK
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to create JIT Admin Template: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @{'Results' = "$Result" }
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUser.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUser.ps1
index 8d679686c945..5fce41b7da5b 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUser.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUser.ps1	
@@ -14,49 +14,75 @@ function Invoke-AddUser {
 
     $UserObj = $Request.Body
 
+    if (!$UserObj.tenantFilter) {
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = [pscustomobject]@{
+                    'Results' = @{
+                        resultText = 'tenantFilter is required to create a user.'
+                        state      = 'error'
+                    }
+                }
+            })
+    }
+
     if ($UserObj.Scheduled.Enabled) {
-        $Username = $UserObj.username ?? $UserObj.mailNickname
-        $TaskBody = [pscustomobject]@{
-            TenantFilter  = $UserObj.tenantFilter
-            Name          = "New user creation: $($Username)@$($UserObj.PrimDomain.value)"
-            Command       = @{
-                value = 'New-CIPPUserTask'
-                label = 'New-CIPPUserTask'
+        try {
+            $Username = $UserObj.username ?? $UserObj.mailNickname
+            $TaskBody = [pscustomobject]@{
+                TenantFilter  = $UserObj.tenantFilter
+                Name          = "New user creation: $($Username)@$($UserObj.PrimDomain.value)"
+                Command       = @{
+                    value = 'New-CIPPUserTask'
+                    label = 'New-CIPPUserTask'
+                }
+                Parameters    = [pscustomobject]@{ UserObj = $UserObj }
+                ScheduledTime = $UserObj.Scheduled.date
+                Reference     = $UserObj.reference ?? $null
+                PostExecution = @{
+                    Webhook = [bool]$Request.Body.PostExecution.Webhook
+                    Email   = [bool]$Request.Body.PostExecution.Email
+                    PSA     = [bool]$Request.Body.PostExecution.PSA
+                }
             }
-            Parameters             = [pscustomobject]@{ UserObj = $UserObj }
-            ScheduledTime          = $UserObj.Scheduled.date
-            Reference              = $UserObj.reference ?? $null
-            PostExecution          = @{
-                Webhook = [bool]$Request.Body.PostExecution.Webhook
-                Email   = [bool]$Request.Body.PostExecution.Email
-                PSA     = [bool]$Request.Body.PostExecution.PSA
+            Add-CIPPScheduledTask -Task $TaskBody -hidden $false -DisallowDuplicateName $true -Headers $Headers
+            $body = [pscustomobject] @{
+                'Results' = @("Successfully created scheduled task to create user $($UserObj.DisplayName)")
             }
-        }
-        Add-CIPPScheduledTask -Task $TaskBody -hidden $false -DisallowDuplicateName $true -Headers $Headers
-        $body = [pscustomobject] @{
-            'Results' = @("Successfully created scheduled task to create user $($UserObj.DisplayName)")
+        } catch {
+            $body = [pscustomobject] @{
+                'Results' = @("Failed to create scheduled task to create user $($UserObj.DisplayName): $($_.Exception.Message)")
+            }
+            $StatusCode = [HttpStatusCode]::InternalServerError
         }
     } else {
-        $CreationResults = New-CIPPUserTask -UserObj $UserObj -APIName $APIName -Headers $Headers
-        $body = [pscustomobject] @{
-            'Results'  = @(
-                $CreationResults.Results[0],
-                $CreationResults.Results[1],
-                @{
-                    'resultText' = $CreationResults.Results[2]
-                    'copyField'  = $CreationResults.password
-                    'state'      = 'success'
+        try {
+            $CreationResults = New-CIPPUserTask -UserObj $UserObj -APIName $APIName -Headers $Headers
+            $body = [pscustomobject] @{
+                'Results'  = @(
+                    $CreationResults.Results[0],
+                    $CreationResults.Results[1],
+                    @{
+                        'resultText' = $CreationResults.Results[2]
+                        'copyField'  = $CreationResults.password
+                        'state'      = 'success'
+                    }
+                )
+                'CopyFrom' = @{
+                    'Success' = $CreationResults.CopyFrom.Success
+                    'Error'   = $CreationResults.CopyFrom.Error
                 }
-            )
-            'CopyFrom' = @{
-                'Success' = $CreationResults.CopyFrom.Success
-                'Error'   = $CreationResults.CopyFrom.Error
+                'User'     = $CreationResults.User
+            }
+        } catch {
+            $body = [pscustomobject] @{
+                'Results' = @("$($_.Exception.Message)")
             }
-            'User'     = $CreationResults.User
+            $StatusCode = [HttpStatusCode]::InternalServerError
         }
     }
     return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
+            StatusCode = $StatusCode ? $StatusCode : [HttpStatusCode]::OK
             Body       = $Body
         })
 
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1
new file mode 100644
index 000000000000..35bbd95139ca
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1	
@@ -0,0 +1,164 @@
+function Invoke-EditJITAdminTemplate {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.Role.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    try {
+        # Extract data from request body
+        $GUID = $Request.Body.GUID
+        $TenantFilter = $Request.Body.tenantFilter
+        $TemplateName = $Request.Body.templateName
+
+        # Validate required fields
+        if ([string]::IsNullOrWhiteSpace($GUID)) {
+            throw 'GUID is required'
+        }
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            throw 'tenantFilter is required'
+        }
+        if ([string]::IsNullOrWhiteSpace($TemplateName)) {
+            throw 'templateName is required'
+        }
+
+        Write-LogMessage -headers $Headers -API $APIName -message "Editing JIT Admin template '$GUID' for tenant: $TenantFilter" -Sev 'Info'
+
+        # Get user info for audit
+        $UserDetails = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails
+
+        # Get the existing template
+        $Table = Get-CippTable -tablename 'templates'
+        $Filter = "PartitionKey eq 'JITAdminTemplate' and RowKey eq '$GUID'"
+        $ExistingTemplate = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+
+        if (!$ExistingTemplate) {
+            throw "Template with GUID '$GUID' not found"
+        }
+
+        # Parse existing template data
+        $ExistingData = $ExistingTemplate.JSON | ConvertFrom-Json -Depth 100
+
+        # Check if template name is unique (excluding current template)
+        $AllTemplates = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'JITAdminTemplate'"
+        $DuplicateName = $AllTemplates | Where-Object { $_.RowKey -ne $GUID } | ForEach-Object {
+            try {
+                $data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+                if ($data.tenantFilter -eq $TenantFilter -and $data.templateName -eq $TemplateName) {
+                    $data
+                }
+            } catch {}
+        }
+
+        if ($DuplicateName) {
+            throw "A template with name '$TemplateName' already exists for tenant '$TenantFilter'"
+        }
+
+        $DefaultForTenant = [bool]$Request.Body.defaultForTenant
+
+        # If this template is being set as default, unset other defaults for this tenant
+        if ($DefaultForTenant) {
+            $AllTemplates | Where-Object { $_.RowKey -ne $GUID } | ForEach-Object {
+                try {
+                    $row = $_
+                    $data = $row.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+                    if ($data.tenantFilter -eq $TenantFilter -and $data.defaultForTenant -eq $true) {
+                        # Unset the default flag
+                        $data.defaultForTenant = $false
+                        $row.JSON = ($data | ConvertTo-Json -Depth 100 -Compress)
+                        Add-CIPPAzDataTableEntity @Table -Entity $row -Force
+                        Write-LogMessage -headers $Headers -API $APIName -message "Unset default flag for existing template: $($data.templateName)" -Sev 'Info'
+                    }
+                } catch {
+                    Write-LogMessage -headers $Headers -API $APIName -message "Failed to update existing template: $($_.Exception.Message)" -Sev 'Warning'
+                }
+            }
+        }
+
+        # Validate user action fields
+        $DefaultUserAction = $Request.Body.defaultUserAction
+        if ($TenantFilter -eq 'AllTenants' -and $DefaultUserAction -eq 'select') {
+            throw 'defaultUserAction cannot be "select" when tenantFilter is "AllTenants"'
+        }
+
+        # Update template object (preserve creation metadata)
+        $TemplateObject = @{
+            tenantFilter                = $TenantFilter
+            templateName                = $TemplateName
+            defaultForTenant            = $DefaultForTenant
+            defaultRoles                = $Request.Body.defaultRoles
+            defaultDuration             = $Request.Body.defaultDuration
+            defaultExpireAction         = $Request.Body.defaultExpireAction
+            defaultNotificationActions  = $Request.Body.defaultNotificationActions
+            generateTAPByDefault        = [bool]$Request.Body.generateTAPByDefault
+            reasonTemplate              = $Request.Body.reasonTemplate
+            createdBy                   = $ExistingData.createdBy
+            createdDate                 = $ExistingData.createdDate
+            modifiedBy                  = $UserDetails
+            modifiedDate                = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+        }
+
+        # Add defaultUserAction if provided
+        if (![string]::IsNullOrWhiteSpace($DefaultUserAction)) {
+            $TemplateObject.defaultUserAction = $DefaultUserAction
+        }
+
+        # Add user detail fields when "create" action is specified
+        if ($DefaultUserAction -eq 'create') {
+            # These fields can be saved for both AllTenants and specific tenant templates
+            if (![string]::IsNullOrWhiteSpace($Request.Body.defaultFirstName)) {
+                $TemplateObject.defaultFirstName = $Request.Body.defaultFirstName
+            }
+            if (![string]::IsNullOrWhiteSpace($Request.Body.defaultLastName)) {
+                $TemplateObject.defaultLastName = $Request.Body.defaultLastName
+            }
+            if (![string]::IsNullOrWhiteSpace($Request.Body.defaultUserName)) {
+                $TemplateObject.defaultUserName = $Request.Body.defaultUserName
+            }
+            
+            # defaultDomain is only saved for specific tenant templates (not AllTenants)
+            if ($TenantFilter -ne 'AllTenants' -and $Request.Body.defaultDomain) {
+                if ($Request.Body.defaultDomain -is [string]) {
+                    if (![string]::IsNullOrWhiteSpace($Request.Body.defaultDomain)) {
+                        $TemplateObject.defaultDomain = $Request.Body.defaultDomain
+                    }
+                } else {
+                    $TemplateObject.defaultDomain = $Request.Body.defaultDomain
+                }
+            }
+        }
+
+        # Convert to JSON
+        $JSON = ConvertTo-Json -InputObject $TemplateObject -Depth 100 -Compress
+
+        # Update in table
+        $Table.Force = $true
+        Add-CIPPAzDataTableEntity @Table -Entity @{
+            JSON         = "$JSON"
+            RowKey       = "$GUID"
+            PartitionKey = 'JITAdminTemplate'
+            GUID         = "$GUID"
+        }
+
+        $Result = "Updated JIT Admin Template '$($TemplateName)' (GUID: $GUID)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Info'
+        $StatusCode = [HttpStatusCode]::OK
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to update JIT Admin Template: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @{'Results' = "$Result" }
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1
index acda628e0a00..2ffcc5041778 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1	
@@ -172,7 +172,7 @@ function Invoke-EditUser {
     if ($AddToGroups) {
         $AddToGroups | ForEach-Object {
 
-            $GroupType = $_.addedFields.calculatedGroupType
+            $GroupType = $_.addedFields.groupType
             $GroupID = $_.value
             $GroupName = $_.label
             Write-Host "About to add $($UserObj.userPrincipalName) to $GroupName. Group ID is: $GroupID and type is: $GroupType"
@@ -204,7 +204,7 @@ function Invoke-EditUser {
     if ($RemoveFromGroups) {
         $RemoveFromGroups | ForEach-Object {
 
-            $GroupType = $_.addedFields.calculatedGroupType
+            $GroupType = $_.addedFields.groupType
             $GroupID = $_.value
             $GroupName = $_.label
             Write-Host "About to remove $($UserObj.userPrincipalName) from $GroupName. Group ID is: $GroupID and type is: $GroupType"
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1
index 9d2db27f7e2a..29bf889d3773 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1	
@@ -28,9 +28,9 @@ function Invoke-ExecBECRemediate {
             $AllResults.Add($PasswordResult)
         } catch {
             $AllResults.Add([pscustomobject]@{
-                resultText = "Failed to reset password: $($_.Exception.Message)"
-                state      = 'error'
-            })
+                    resultText = "Failed to reset password: $($_.Exception.Message)"
+                    state      = 'error'
+                })
         }
 
         # Step 2: Disable Account
@@ -38,14 +38,14 @@ function Invoke-ExecBECRemediate {
         try {
             $DisableResult = Set-CIPPSignInState -userid $Username -AccountEnabled $false -tenantFilter $TenantFilter -APIName $APIName -Headers $Headers
             $AllResults.Add([pscustomobject]@{
-                resultText = $DisableResult
-                state      = if ($DisableResult -like "*WARNING*") { 'warning' } else { 'success' }
-            })
+                    resultText = $DisableResult
+                    state      = if ($DisableResult -like '*WARNING*') { 'warning' } else { 'success' }
+                })
         } catch {
             $AllResults.Add([pscustomobject]@{
-                resultText = "Failed to disable account: $($_.Exception.Message)"
-                state      = 'error'
-            })
+                    resultText = "Failed to disable account: $($_.Exception.Message)"
+                    state      = 'error'
+                })
         }
 
         # Step 3: Revoke Sessions
@@ -53,14 +53,14 @@ function Invoke-ExecBECRemediate {
         try {
             $SessionResult = Revoke-CIPPSessions -userid $SuspectUser -username $Username -Headers $Headers -APIName $APIName -tenantFilter $TenantFilter
             $AllResults.Add([pscustomobject]@{
-                resultText = $SessionResult
-                state      = if ($SessionResult -like "*Failed*") { 'error' } else { 'success' }
-            })
+                    resultText = $SessionResult
+                    state      = if ($SessionResult -like '*Failed*') { 'error' } else { 'success' }
+                })
         } catch {
             $AllResults.Add([pscustomobject]@{
-                resultText = "Failed to revoke sessions: $($_.Exception.Message)"
-                state      = 'error'
-            })
+                    resultText = "Failed to revoke sessions: $($_.Exception.Message)"
+                    state      = 'error'
+                })
         }
 
         # Step 4: Remove MFA methods
@@ -68,14 +68,14 @@ function Invoke-ExecBECRemediate {
         try {
             $MFAResult = Remove-CIPPUserMFA -UserPrincipalName $Username -TenantFilter $TenantFilter -Headers $Headers
             $AllResults.Add([pscustomobject]@{
-                resultText = $MFAResult
-                state      = if ($MFAResult -like "*No MFA methods*") { 'info' } elseif ($MFAResult -like "*Successfully*") { 'success' } else { 'error' }
-            })
+                    resultText = $MFAResult
+                    state      = if ($MFAResult -like '*No MFA methods*') { 'info' } elseif ($MFAResult -like '*Successfully*') { 'success' } else { 'error' }
+                })
         } catch {
             $AllResults.Add([pscustomobject]@{
-                resultText = "Failed to remove MFA methods: $($_.Exception.Message)"
-                state      = 'error'
-            })
+                    resultText = "Failed to remove MFA methods: $($_.Exception.Message)"
+                    state      = 'error'
+                })
         }
 
         # Step 5: Disable Inbox Rules
@@ -92,9 +92,9 @@ function Invoke-ExecBECRemediate {
             if (($Rules | Measure-Object).Count -eq 0) {
                 # No rules exist at all
                 $AllResults.Add([pscustomobject]@{
-                    resultText = "No Inbox Rules found for $Username."
-                    state      = 'info'
-                })
+                        resultText = "No Inbox Rules found for $Username."
+                        state      = 'info'
+                    })
             } else {
                 # Rules exist, filter and process them
                 $ProcessableRules = $Rules | Where-Object {
@@ -107,9 +107,9 @@ function Invoke-ExecBECRemediate {
                     $SystemRulesCount = ($Rules | Measure-Object).Count - $DelegateRulesSkipped
                     if ($SystemRulesCount -gt 0) {
                         $AllResults.Add([pscustomobject]@{
-                            resultText = "Found $(($Rules | Measure-Object).Count) inbox rules for $Username, but none require disabling (only system rules found)."
-                            state      = 'info'
-                        })
+                                resultText = "Found $(($Rules | Measure-Object).Count) inbox rules for $Username, but none require disabling (only system rules found)."
+                                state      = 'info'
+                            })
                     }
                 } else {
                     # Process the filterable rules
@@ -118,7 +118,7 @@ function Invoke-ExecBECRemediate {
                         Write-LogMessage -headers $Headers -API $APIName -message "Processing rule: Name='$($CurrentRule.Name)', Identity='$($CurrentRule.Identity)'" -Sev 'Info' -tenant $TenantFilter
 
                         try {
-                            Set-CIPPMailboxRule -Username $Username -TenantFilter $TenantFilter -RuleId $CurrentRule.Identity -RuleName $CurrentRule.Name -Disable -APIName $APIName -Headers $Headers
+                            Set-CIPPMailboxRule -Username $Username -UserId $Username -TenantFilter $TenantFilter -RuleId $CurrentRule.Identity -RuleName $CurrentRule.Name -Disable -APIName $APIName -Headers $Headers
 
                             Write-LogMessage -headers $Headers -API $APIName -message "Successfully disabled rule: $($CurrentRule.Name)" -Sev 'Info' -tenant $TenantFilter
                             $RuleDisabled++
@@ -140,29 +140,29 @@ function Invoke-ExecBECRemediate {
                     # Report results
                     if ($RuleDisabled -gt 0) {
                         $AllResults.Add([pscustomobject]@{
-                            resultText = "Successfully disabled $RuleDisabled inbox rules for $Username"
-                            state      = 'success'
-                        })
+                                resultText = "Successfully disabled $RuleDisabled inbox rules for $Username"
+                                state      = 'success'
+                            })
                     } elseif ($DelegateRulesSkipped -gt 0 -and $RuleDisabled -eq 0 -and $RuleFailed -eq 0) {
                         # Only system rules were found, report as no processable rules
                         $AllResults.Add([pscustomobject]@{
-                            resultText = "No processable inbox rules found for $Username"
-                            state      = 'info'
-                        })
+                                resultText = "No processable inbox rules found for $Username"
+                                state      = 'info'
+                            })
                     }
 
                     if ($RuleFailed -gt 0) {
                         $AllResults.Add([pscustomobject]@{
-                            resultText = "Failed to process $RuleFailed inbox rules for $Username"
-                            state      = 'warning'
-                        })
+                                resultText = "Failed to process $RuleFailed inbox rules for $Username"
+                                state      = 'warning'
+                            })
 
                         # Add individual rule failure messages as objects
                         foreach ($RuleMessage in $RuleMessages) {
                             $AllResults.Add([pscustomobject]@{
-                                resultText = $RuleMessage
-                                state      = 'error'
-                            })
+                                    resultText = $RuleMessage
+                                    state      = 'error'
+                                })
                         }
                     }
                 }
@@ -175,9 +175,9 @@ function Invoke-ExecBECRemediate {
             $ErrorMsg = "Failed to process inbox rules: $($_.Exception.Message)"
             Write-LogMessage -headers $Headers -API $APIName -message $ErrorMsg -Sev 'Error' -tenant $TenantFilter
             $AllResults.Add([pscustomobject]@{
-                resultText = $ErrorMsg
-                state      = 'error'
-            })
+                    resultText = $ErrorMsg
+                    state      = 'error'
+                })
         }
 
         $StatusCode = [HttpStatusCode]::OK
@@ -190,9 +190,9 @@ function Invoke-ExecBECRemediate {
         $ErrorMessage = Get-CippException -Exception $_
         $ErrorList = [System.Collections.Generic.List[object]]::new()
         $ErrorList.Add([pscustomobject]@{
-            resultText = "Failed to execute remediation at step '$Step'. $($ErrorMessage.NormalizedError)"
-            state      = 'error'
-        })
+                resultText = "Failed to execute remediation at step '$Step'. $($ErrorMessage.NormalizedError)"
+                state      = 'error'
+            })
         Write-LogMessage -API 'BECRemediate' -tenant $TenantFilter -message "Executed Remediation for $Username failed at the $Step step" -sev 'Error' -LogData $ErrorMessage
         $StatusCode = [HttpStatusCode]::InternalServerError
 
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1
index 3a054bc4f0f7..4eca5bd0cbe8 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecJITAdmin.ps1	
@@ -20,6 +20,39 @@ function Invoke-ExecJITAdmin {
     $Expiration = ([System.DateTimeOffset]::FromUnixTimeSeconds($Request.Body.EndDate)).DateTime.ToLocalTime()
     $Results = [System.Collections.Generic.List[object]]::new()
 
+    # Check maximum duration setting
+    try {
+        $ConfigTable = Get-CIPPTable -TableName Config
+        $Filter = "PartitionKey eq 'JITAdminSettings' and RowKey eq 'JITAdminSettings'"
+        $JITAdminConfig = Get-CIPPAzDataTableEntity @ConfigTable -Filter $Filter
+        
+        if ($JITAdminConfig -and ![string]::IsNullOrWhiteSpace($JITAdminConfig.MaxDuration)) {
+            # Calculate the duration between start and expiration
+            $RequestedDuration = $Expiration - $Start
+            
+            # Parse the max duration from ISO 8601 format
+            try {
+                $MaxDurationTimeSpan = [System.Xml.XmlConvert]::ToTimeSpan($JITAdminConfig.MaxDuration)
+                
+                if ($RequestedDuration -gt $MaxDurationTimeSpan) {
+                    $RequestedDays = $RequestedDuration.TotalDays.ToString('0.00')
+                    $MaxDays = $MaxDurationTimeSpan.TotalDays.ToString('0.00')
+                    $ErrorMessage = "Requested JIT Admin duration ($RequestedDays days) exceeds the maximum allowed duration of $($JITAdminConfig.MaxDuration) ($MaxDays days)"
+                    Write-LogMessage -headers $Headers -API $APIName -message $ErrorMessage -Sev 'Error'
+                    return ([HttpResponseContext]@{
+                            StatusCode = [HttpStatusCode]::BadRequest
+                            Body       = @{'Results' = @($ErrorMessage) }
+                        })
+                }
+            } catch {
+                Write-Warning "Failed to parse MaxDuration setting: $($_.Exception.Message)"
+            }
+        }
+    } catch {
+        Write-Warning "Failed to check JIT Admin max duration setting: $($_.Exception.Message)"
+        # Continue execution if we can't check the setting
+    }
+
     if ($Request.Body.userAction -eq 'create') {
         $Domain = $Request.Body.Domain.value ? $Request.Body.Domain.value : $Request.Body.Domain
         $Username = "$($Request.Body.Username)@$($Domain)"
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminTemplates.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminTemplates.ps1
new file mode 100644
index 000000000000..aa5ad886758e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListJITAdminTemplates.ps1	
@@ -0,0 +1,72 @@
+function Invoke-ListJITAdminTemplates {
+    <#
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+    .ROLE
+        Identity.Role.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    # Get the TenantFilter from query parameters
+    $TenantFilter = $Request.Query.TenantFilter
+
+    # Get the includeAllTenants flag from query or body parameters (defaults to true)
+    $IncludeAllTenants = if ($Request.Query.includeAllTenants -eq 'false' -or $Request.Body.includeAllTenants -eq 'false') {
+        $false
+    } else {
+        $true
+    }
+
+    # Get the templates table
+    $Table = Get-CippTable -tablename 'templates'
+    $Filter = "PartitionKey eq 'JITAdminTemplate'"
+
+    # Retrieve all JIT Admin templates
+    $Templates = (Get-CIPPAzDataTableEntity @Table -Filter $Filter) | ForEach-Object {
+        try {
+            $row = $_
+            $data = $row.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+            $data | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $row.GUID -Force
+            $data | Add-Member -NotePropertyName 'RowKey' -NotePropertyValue $row.RowKey -Force
+            $data
+        } catch {
+            Write-LogMessage -headers $Headers -API $APIName -message "Failed to process JIT Admin template: $($row.RowKey) - $($_.Exception.Message)" -Sev 'Warning'
+        }
+    }
+
+    # Filter by tenant if TenantFilter is provided
+    if ($TenantFilter) {
+        if ($TenantFilter -eq 'AllTenants') {
+            # When requesting AllTenants, return only templates stored under AllTenants
+            $Templates = $Templates | Where-Object -Property tenantFilter -EQ 'AllTenants'
+        } else {
+            # When requesting a specific tenant
+            if ($IncludeAllTenants) {
+                # Include both tenant-specific and AllTenants templates
+                $Templates = $Templates | Where-Object { $_.tenantFilter -eq $TenantFilter -or $_.tenantFilter -eq 'AllTenants' }
+            } else {
+                # Return only tenant-specific templates (exclude AllTenants)
+                $Templates = $Templates | Where-Object -Property tenantFilter -EQ $TenantFilter
+            }
+        }
+    }
+
+    # Sort by template name
+    $Templates = $Templates | Sort-Object -Property templateName
+
+    # If a specific GUID is requested, filter to that template
+    if ($Request.query.GUID) {
+        $Templates = $Templates | Where-Object -Property GUID -EQ $Request.query.GUID
+    }
+
+    $Templates = ConvertTo-Json -InputObject @($Templates) -Depth 100
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = $Templates
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserTrustedBlockedSenders.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserTrustedBlockedSenders.ps1
new file mode 100644
index 000000000000..96e89c7397f4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserTrustedBlockedSenders.ps1	
@@ -0,0 +1,55 @@
+function Invoke-ListUserTrustedBlockedSenders {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Exchange.Mailbox.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    $TenantFilter = $Request.Query.tenantFilter
+    $UserID = $Request.Query.UserID
+    $UserPrincipalName = $Request.Query.userPrincipalName
+
+    try {
+        $Config = New-ExoRequest -Anchor $UserID -tenantid $TenantFilter -cmdlet 'Get-MailboxJunkEmailConfiguration' -cmdParams @{Identity = $UserID }
+
+        $Result = [System.Collections.Generic.List[PSObject]]::new()
+        $Properties = @(
+            @{ Name = 'TrustedSendersAndDomains'; FriendlyName = 'Trusted Sender/Domain' },
+            @{ Name = 'BlockedSendersAndDomains'; FriendlyName = 'Blocked Sender/Domain' }
+        )
+
+        foreach ($Prop in $Properties) {
+            if ($Config.$($Prop.Name)) {
+                foreach ($Value in $Config.$($Prop.Name)) {
+                    if ($Value) {
+                        $null = $Result.Add([PSCustomObject]@{
+                                UserPrincipalName = $UserPrincipalName
+                                UserID            = $UserID
+                                Type              = $Prop.FriendlyName
+                                TypeProperty      = $Prop.Name
+                                Value             = $Value
+                            })
+                    }
+                }
+            }
+        }
+
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to retrieve junk email configuration for $UserID : Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -Headers $Headers -tenant $TenantFilter -API $APIName -message $Result -Sev Error -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @($Result)
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-RemoveJITAdminTemplate.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-RemoveJITAdminTemplate.ps1
new file mode 100644
index 000000000000..e0ac56a8f294
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-RemoveJITAdminTemplate.ps1	
@@ -0,0 +1,47 @@
+function Invoke-RemoveJITAdminTemplate {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.Role.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    try {
+        $ID = $Request.Query.ID ?? $Request.Body.ID
+        
+        if ([string]::IsNullOrWhiteSpace($ID)) {
+            throw 'ID is required'
+        }
+
+        $Table = Get-CippTable -tablename 'templates'
+        $Filter = "PartitionKey eq 'JITAdminTemplate' and RowKey eq '$ID'"
+        $Template = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+
+        if ($Template) {
+            Remove-AzDataTableEntity @Table -Entity $Template
+            $Result = "Successfully deleted JIT Admin Template with ID: $ID"
+            Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Info'
+            $StatusCode = [HttpStatusCode]::OK
+        } else {
+            $Result = "JIT Admin Template with ID $ID not found"
+            Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Warning'
+            $StatusCode = [HttpStatusCode]::NotFound
+        }
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to delete JIT Admin Template: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @{'Results' = "$Result" }
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-RemoveTrustedBlockedSender.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-RemoveTrustedBlockedSender.ps1
new file mode 100644
index 000000000000..e9607e4cf27c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-RemoveTrustedBlockedSender.ps1	
@@ -0,0 +1,41 @@
+function Invoke-RemoveTrustedBlockedSender {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Exchange.Mailbox.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    # Interact with the query or body of the request
+    $TenantFilter = $Request.Body.tenantFilter
+    $TypeProperty = $Request.Body.typeProperty
+    $Value = $Request.Body.value
+    $UserPrincipalName = $Request.Body.userPrincipalName
+
+    try {
+        $removeParams = @{
+            UserPrincipalName = $UserPrincipalName
+            TenantFilter      = $TenantFilter
+            APIName           = $APIName
+            Headers           = $Headers
+            TypeProperty      = $TypeProperty
+            Value             = $Value
+        }
+        $Results = Remove-CIPPTrustedBlockedSender @removeParams
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $Results = $_.Exception.Message
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @{ 'Results' = $Results }
+        })
+
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1
index 65c79f2bb82c..04d6ceed951f 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1	
@@ -1,4 +1,4 @@
-Function Invoke-ListMFAUsers {
+function Invoke-ListMFAUsers {
     <#
     .FUNCTIONALITY
         Entrypoint
@@ -9,48 +9,69 @@ Function Invoke-ListMFAUsers {
     param($Request, $TriggerMetadata)
     # Interact with query parameters or the body of the request.
     $TenantFilter = $Request.Query.tenantFilter
+    $UseReportDB = $Request.Query.UseReportDB
 
-    if ($TenantFilter -ne 'AllTenants') {
-        $GraphRequest = Get-CIPPMFAState -TenantFilter $TenantFilter
-    } else {
-        $Table = Get-CIPPTable -TableName cachemfa
+    try {
+        # If UseReportDB is specified, retrieve from report database
+        if ($UseReportDB -eq 'true') {
+            $GraphRequest = Get-CIPPMFAStateReport -TenantFilter $TenantFilter
+            $StatusCode = [HttpStatusCode]::OK
 
-        $Rows = Get-CIPPAzDataTableEntity @Table | Where-Object -Property Timestamp -GT (Get-Date).AddHours(-2)
-        if (!$Rows) {
-            $TenantList = Get-Tenants -IncludeErrors
-            $Queue = New-CippQueueEntry -Name 'MFA Users - All Tenants' -Link '/identity/reports/mfa-report?customerId=AllTenants' -TotalTasks ($TenantList | Measure-Object).Count
-            Write-Information ($Queue | ConvertTo-Json)
-            $GraphRequest = [PSCustomObject]@{
-                UPN = 'Loading data for all tenants. Please check back in a few minutes'
-            }
-            $Batch = $TenantList | ForEach-Object {
-                $_ | Add-Member -NotePropertyName FunctionName -NotePropertyValue 'ListMFAUsersQueue'
-                $_ | Add-Member -NotePropertyName QueueId -NotePropertyValue $Queue.RowKey
-                $_
-            }
-            if (($Batch | Measure-Object).Count -gt 0) {
-                $InputObject = [PSCustomObject]@{
-                    OrchestratorName = 'ListMFAUsersOrchestrator'
-                    Batch            = @($Batch)
-                    SkipLog          = $true
-                }
-                #Write-Host ($InputObject | ConvertTo-Json)
-                $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 5 -Compress)
-                Write-Host "Started permissions orchestration with ID = '$InstanceId'"
-            }
+            return ([HttpResponseContext]@{
+                    StatusCode = $StatusCode
+                    Body       = @($GraphRequest)
+                })
+        }
+
+        # Original cache table logic
+        if ($TenantFilter -ne 'AllTenants') {
+            $GraphRequest = Get-CIPPMFAState -TenantFilter $TenantFilter
         } else {
-            $Rows = foreach ($Row in $Rows) {
-                if ($Row.CAPolicies) {
-                    $Row.CAPolicies = try { $Row.CAPolicies | ConvertFrom-Json } catch { $Row.CAPolicies }
+            $Table = Get-CIPPTable -TableName cachemfa
+
+            $Rows = Get-CIPPAzDataTableEntity @Table | Where-Object -Property Timestamp -GT (Get-Date).AddHours(-2)
+            if (!$Rows) {
+                $TenantList = Get-Tenants -IncludeErrors
+                $Queue = New-CippQueueEntry -Name 'MFA Users - All Tenants' -Link '/identity/reports/mfa-report?customerId=AllTenants' -TotalTasks ($TenantList | Measure-Object).Count
+                Write-Information ($Queue | ConvertTo-Json)
+                $GraphRequest = [PSCustomObject]@{
+                    UPN = 'Loading data for all tenants. Please check back in a few minutes'
+                }
+                $Batch = $TenantList | ForEach-Object {
+                    $_ | Add-Member -NotePropertyName FunctionName -NotePropertyValue 'ListMFAUsersQueue'
+                    $_ | Add-Member -NotePropertyName QueueId -NotePropertyValue $Queue.RowKey
+                    $_
                 }
-                if ($Row.MFAMethods) {
-                    $Row.MFAMethods = try { $Row.MFAMethods | ConvertFrom-Json } catch { $Row.MFAMethods }
+                if (($Batch | Measure-Object).Count -gt 0) {
+                    $InputObject = [PSCustomObject]@{
+                        OrchestratorName = 'ListMFAUsersOrchestrator'
+                        Batch            = @($Batch)
+                        SkipLog          = $true
+                    }
+                    #Write-Host ($InputObject | ConvertTo-Json)
+                    $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 5 -Compress)
+                    Write-Host "Started permissions orchestration with ID = '$InstanceId'"
                 }
-                $Row
+            } else {
+                $Rows = foreach ($Row in $Rows) {
+                    if ($Row.CAPolicies) {
+                        $Row.CAPolicies = try { $Row.CAPolicies | ConvertFrom-Json } catch { $Row.CAPolicies }
+                    }
+                    if ($Row.MFAMethods) {
+                        $Row.MFAMethods = try { $Row.MFAMethods | ConvertFrom-Json } catch { $Row.MFAMethods }
+                    }
+                    $Row
+                }
+                $GraphRequest = $Rows
             }
-            $GraphRequest = $Rows
         }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+        $StatusCode = [HttpStatusCode]::Forbidden
+        $GraphRequest = $ErrorMessage
     }
+
     return ([HttpResponseContext]@{
             StatusCode = [HttpStatusCode]::OK
             Body       = @($GraphRequest)
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-AddTestReport.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-AddTestReport.ps1
new file mode 100644
index 000000000000..c0038feec179
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-AddTestReport.ps1	
@@ -0,0 +1,60 @@
+function Invoke-AddTestReport {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.Dashboard.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $Body = $Request.Body
+
+        # Validate required fields
+        if ([string]::IsNullOrEmpty($Body.name)) {
+            throw 'Report name is required'
+        }
+
+        # Generate a unique ID
+        $ReportId = New-Guid
+        $IdentityTests = $Body.IdentityTests ? ($Body.IdentityTests | ConvertTo-Json -Compress) : '[]'
+        $DevicesTests = $Body.DevicesTests ? ($Body.DevicesTests | ConvertTo-Json -Compress) : '[]'
+
+        # Create report object
+        $Report = [PSCustomObject]@{
+            PartitionKey  = 'Report'
+            RowKey        = [string]$ReportId
+            name          = [string]$Body.name
+            description   = [string]$Body.description
+            version       = '1.0'
+            IdentityTests = [string]$IdentityTests
+            DevicesTests  = [string]$DevicesTests
+            CreatedAt     = [string](Get-Date).ToString('o')
+        }
+
+        # Save to table
+        $Table = Get-CippTable -tablename 'CippReportTemplates'
+        Add-CIPPAzDataTableEntity -Entity $Report @Table
+        $Body = [PSCustomObject]@{
+            Results  = 'Successfully created custom report'
+            ReportId = $ReportId
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message "Failed to create report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        $Body = [PSCustomObject]@{
+            Results = "Failed to create report: $($ErrorMessage.NormalizedError)"
+        }
+        $StatusCode = [HttpStatusCode]::BadRequest
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = ConvertTo-Json -InputObject $Body -Depth 10
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-DeleteTestReport.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-DeleteTestReport.ps1
new file mode 100644
index 000000000000..ed502f467c1e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-DeleteTestReport.ps1	
@@ -0,0 +1,37 @@
+function Invoke-DeleteTestReport {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.Dashboard.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $ReportId = $Request.Body.ReportId
+        $Table = Get-CippTable -tablename 'CippReportTemplates'
+        $ExistingReport = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$ReportId'"
+        Remove-AzDataTableEntity @Table -Entity $ExistingReport
+
+        $Body = [PSCustomObject]@{
+            Results = 'Successfully deleted custom report'
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message "Failed to delete report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        $Body = [PSCustomObject]@{
+            Results = "Failed to delete report: $($ErrorMessage.NormalizedError)"
+        }
+        $StatusCode = [HttpStatusCode]::BadRequest
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = ConvertTo-Json -InputObject $Body -Depth 10
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1
new file mode 100644
index 000000000000..bbf455e74581
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1	
@@ -0,0 +1,54 @@
+function Invoke-ExecTestRun {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Tests.ReadWrite
+    #>
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Starting data collection and test run for tenant: $TenantFilter" -sev Info
+        $Batch = @(
+            @{
+                FunctionName = 'CIPPDBCacheData'
+                TenantFilter = $TenantFilter
+                QueueId      = $Queue.RowKey
+                QueueName    = "Cache - $TenantFilter"
+            }
+        )
+        $InputObject = [PSCustomObject]@{
+            OrchestratorName = 'TestDataCollectionAndRun'
+            Batch            = $Batch
+            PostExecution    = @{
+                FunctionName = 'CIPPTestsRun'
+                Parameters   = @{
+                    TenantFilter = $TenantFilter
+                }
+            }
+            SkipLog          = $false
+        }
+
+        $InstanceId = Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Depth 5 -Compress)
+
+        $StatusCode = [HttpStatusCode]::OK
+        $Body = [PSCustomObject]@{ Results = "Successfully started data collection and test run for $TenantFilter" }
+
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Data collection and test run orchestration started. Instance ID: $InstanceId" -sev Info
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Failed to start data collection/test run: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::BadRequest
+        $Body = @{ Message = "Failed to start data collection/test run for $TenantFilter" }
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListAvailableTests.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListAvailableTests.ps1
new file mode 100644
index 000000000000..ceee5d026d31
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListAvailableTests.ps1	
@@ -0,0 +1,86 @@
+function Invoke-ListAvailableTests {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.Dashboard.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -user $Request.Headers.'x-ms-client-principal' -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        # Get all test folders
+        $TestFolders = Get-ChildItem 'Modules\CIPPCore\Public\Tests' -Directory
+
+        # Build identity tests array
+        $IdentityTests = foreach ($TestFolder in $TestFolders) {
+            $IdentityTestFiles = Get-ChildItem "$($TestFolder.FullName)\Identity\*.ps1" -ErrorAction SilentlyContinue
+            foreach ($TestFile in $IdentityTestFiles) {
+                # Extract test ID from filename (e.g., Invoke-CippTestZTNA21772.ps1 -> ZTNA21772)
+                if ($TestFile.BaseName -match 'Invoke-CippTest(.+)$') {
+                    $TestId = $Matches[1]
+
+                    # Try to get test metadata from the file
+                    $TestContent = Get-Content $TestFile.FullName -Raw
+                    $TestName = $TestId
+
+                    # Try to extract Synopsis from comment-based help
+                    if ($TestContent -match '\.SYNOPSIS\s+(.+?)(?=\s+\.|\s+#>|\s+\[)') {
+                        $TestName = $Matches[1].Trim()
+                    }
+
+                    [PSCustomObject]@{
+                        id         = $TestId
+                        name       = $TestName
+                        category   = 'Identity'
+                        testFolder = $TestFolder.Name
+                    }
+                }
+            }
+        }
+
+        # Build device tests array
+        $DevicesTests = foreach ($TestFolder in $TestFolders) {
+            $DeviceTestFiles = Get-ChildItem "$($TestFolder.FullName)\Devices\*.ps1" -ErrorAction SilentlyContinue
+            foreach ($TestFile in $DeviceTestFiles) {
+                if ($TestFile.BaseName -match 'Invoke-CippTest(.+)$') {
+                    $TestId = $Matches[1]
+
+                    $TestContent = Get-Content $TestFile.FullName -Raw
+                    $TestName = $TestId
+
+                    if ($TestContent -match '\.SYNOPSIS\s+(.+?)(?=\s+\.|\s+#>|\s+\[)') {
+                        $TestName = $Matches[1].Trim()
+                    }
+
+                    [PSCustomObject]@{
+                        id         = $TestId
+                        name       = $TestName
+                        category   = 'Devices'
+                        testFolder = $TestFolder.Name
+                    }
+                }
+            }
+        }
+
+        $Body = [PSCustomObject]@{
+            IdentityTests = $IdentityTests
+            DevicesTests  = $DevicesTests
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Body = [PSCustomObject]@{
+            Results = "Failed to list available tests: $($ErrorMessage.NormalizedError)"
+        }
+        $StatusCode = [HttpStatusCode]::BadRequest
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = ConvertTo-Json -InputObject $Body -Depth 10
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListTestReports.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListTestReports.ps1
new file mode 100644
index 000000000000..eae3538134ce
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListTestReports.ps1	
@@ -0,0 +1,69 @@
+function Invoke-ListTestReports {
+    <#
+    .SYNOPSIS
+        Lists all available test reports from JSON files and database
+
+    .FUNCTIONALITY
+        Entrypoint
+
+    .ROLE
+        Tenant.Reports.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        # Get reports from JSON files in test folders
+        $FileReports = Get-ChildItem 'Modules\CIPPCore\Public\Tests\*\report.json' -ErrorAction SilentlyContinue | ForEach-Object {
+            try {
+                $ReportContent = Get-Content $_.FullName -Raw | ConvertFrom-Json
+                $FolderName = $_.Directory.Name
+                [PSCustomObject]@{
+                    id          = $FolderName.ToLower()
+                    name        = $ReportContent.name ?? $FolderName
+                    description = $ReportContent.description ?? ''
+                    version     = $ReportContent.version ?? '1.0'
+                    source      = 'file'
+                    type        = $FolderName
+                }
+            } catch {
+                Write-LogMessage -API $APIName -message "Error reading report.json from $($_.Directory.Name): $($_.Exception.Message)" -sev Warning
+            }
+        }
+
+        # Get custom reports from CippReportTemplates table
+        $ReportTable = Get-CippTable -tablename 'CippReportTemplates'
+        $Filter = "PartitionKey eq 'Report'"
+        $CustomReports = Get-CIPPAzDataTableEntity @ReportTable -Filter $Filter
+
+        $DatabaseReports = foreach ($Report in $CustomReports) {
+            [PSCustomObject]@{
+                id          = $Report.RowKey
+                name        = $Report.Name ?? 'Custom Report'
+                description = $Report.Description ?? ''
+                version     = $Report.Version ?? '1.0'
+                source      = 'database'
+                type        = 'custom'
+            }
+        }
+
+        $Reports = @($FileReports) + @($DatabaseReports)
+
+        $StatusCode = [HttpStatusCode]::OK
+        $Body = @($Reports)
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API $APIName -message "Error retrieving test reports: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::BadRequest
+        $Body = @{ Error = $ErrorMessage.NormalizedError }
+    }
+
+    return([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = ConvertTo-Json -InputObject $Body -Depth 10 -Compress
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListTests.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListTests.ps1
new file mode 100644
index 000000000000..08946b093fe9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Invoke-ListTests.ps1	
@@ -0,0 +1,163 @@
+function Invoke-ListTests {
+    <#
+    .SYNOPSIS
+        Lists tests for a tenant, optionally filtered by report ID
+
+    .FUNCTIONALITY
+        Entrypoint
+
+    .ROLE
+        Tenant.Reports.Read
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -user $request.headers.'x-ms-client-principal' -API $APINAME -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        $ReportId = $Request.Query.reportId ?? $Request.Body.reportId
+
+        if (-not $TenantFilter) {
+            throw 'TenantFilter parameter is required'
+        }
+
+        $TestResultsData = Get-CIPPTestResults -TenantFilter $TenantFilter
+
+        $IdentityTotal = 0
+        $DevicesTotal = 0
+        $IdentityTests = @()
+        $DevicesTests = @()
+
+        if ($ReportId) {
+            $ReportJsonFiles = Get-ChildItem 'Modules\CIPPCore\Public\Tests\*\report.json' -ErrorAction SilentlyContinue
+            $ReportFound = $false
+
+            $MatchingReport = $ReportJsonFiles | Where-Object { $_.Directory.Name.ToLower() -eq $ReportId.ToLower() } | Select-Object -First 1
+
+            if ($MatchingReport) {
+                try {
+                    $ReportContent = Get-Content $MatchingReport.FullName -Raw | ConvertFrom-Json
+                    if ($ReportContent.IdentityTests) {
+                        $IdentityTests = $ReportContent.IdentityTests
+                        $IdentityTotal = @($IdentityTests).Count
+                    }
+                    if ($ReportContent.DevicesTests) {
+                        $DevicesTests = $ReportContent.DevicesTests
+                        $DevicesTotal = @($DevicesTests).Count
+                    }
+                    $ReportFound = $true
+                } catch {
+                    Write-LogMessage -API $APIName -tenant $TenantFilter -message "Error reading report.json: $($_.Exception.Message)" -sev Warning
+                }
+            }
+
+            # Fall back to database if not found in JSON files
+            if (-not $ReportFound) {
+                $ReportTable = Get-CippTable -tablename 'CippReportTemplates'
+                $Filter = "PartitionKey eq 'Report' and RowKey eq '{0}'" -f $ReportId
+                $ReportTemplate = Get-CIPPAzDataTableEntity @ReportTable -Filter $Filter
+
+                if ($ReportTemplate) {
+                    if ($ReportTemplate.identityTests) {
+                        $IdentityTests = $ReportTemplate.identityTests | ConvertFrom-Json
+                        $IdentityTotal = @($IdentityTests).Count
+                    }
+
+                    if ($ReportTemplate.DevicesTests) {
+                        $DevicesTests = $ReportTemplate.DevicesTests | ConvertFrom-Json
+                        $DevicesTotal = @($DevicesTests).Count
+                    }
+                    $ReportFound = $true
+                } else {
+                    Write-LogMessage -API $APIName -tenant $TenantFilter -message "Report template '$ReportId' not found" -sev Warning
+                }
+            }
+
+            # Filter tests if report was found
+            if ($ReportFound) {
+                $AllReportTests = $IdentityTests + $DevicesTests
+                # Use HashSet for O(1) lookup performance
+                $TestLookup = [System.Collections.Generic.HashSet[string]]::new()
+                foreach ($test in $AllReportTests) {
+                    [void]$TestLookup.Add($test)
+                }
+                $FilteredTests = $TestResultsData.TestResults | Where-Object { $TestLookup.Contains($_.RowKey) }
+                $TestResultsData.TestResults = @($FilteredTests)
+            } else {
+                $TestResultsData.TestResults = @()
+            }
+        } else {
+            $IdentityTotal = @($TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Identity' }).Count
+            $DevicesTotal = @($TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Devices' }).Count
+        }
+
+        $IdentityResults = $TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Identity' }
+        $DeviceResults = $TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Devices' }
+
+        # Add descriptions from markdown files to each test result
+        foreach ($TestResult in $TestResultsData.TestResults) {
+            $MdFile = Get-ChildItem -Path 'Modules\CIPPCore\Public\Tests' -Filter "*$($TestResult.RowKey).md" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
+            if ($MdFile) {
+                try {
+                    $MdContent = Get-Content $MdFile.FullName -Raw -ErrorAction SilentlyContinue
+                    if ($MdContent) {
+                        $Description = ($MdContent -split '<!--- Results --->')[0].Trim()
+                        $Description = ($Description -split '%TestResult%')[0].Trim()
+                        $TestResult | Add-Member -NotePropertyName 'Description' -NotePropertyValue $Description -Force
+                    }
+                } catch {
+                    #Test
+                }
+            }
+        }
+
+        $TestCounts = @{
+            Identity = @{
+                Passed      = @($IdentityResults | Where-Object { $_.Status -eq 'Passed' }).Count
+                Failed      = @($IdentityResults | Where-Object { $_.Status -eq 'Failed' }).Count
+                Investigate = @($IdentityResults | Where-Object { $_.Status -eq 'Investigate' }).Count
+                Skipped     = @($IdentityResults | Where-Object { $_.Status -eq 'Skipped' }).Count
+                Total       = $IdentityTotal
+            }
+            Devices  = @{
+                Passed      = @($DeviceResults | Where-Object { $_.Status -eq 'Passed' }).Count
+                Failed      = @($DeviceResults | Where-Object { $_.Status -eq 'Failed' }).Count
+                Investigate = @($DeviceResults | Where-Object { $_.Status -eq 'Investigate' }).Count
+                Skipped     = @($DeviceResults | Where-Object { $_.Status -eq 'Skipped' }).Count
+                Total       = $DevicesTotal
+            }
+        }
+
+        $TestResultsData | Add-Member -NotePropertyName 'TestCounts' -NotePropertyValue $TestCounts -Force
+
+        $SecureScoreData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'SecureScore'
+        if ($SecureScoreData) {
+            $TestResultsData | Add-Member -NotePropertyName 'SecureScore' -NotePropertyValue @($SecureScoreData) -Force
+        }
+        $MFAStateData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'MFAState'
+        if ($MFAStateData) {
+            $TestResultsData | Add-Member -NotePropertyName 'MFAState' -NotePropertyValue @($MFAStateData) -Force
+        }
+
+        $LicenseData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'LicenseOverview'
+        if ($LicenseData) {
+            $TestResultsData | Add-Member -NotePropertyName 'LicenseData' -NotePropertyValue @($LicenseData) -Force
+        }
+
+        $StatusCode = [HttpStatusCode]::OK
+        $Body = $TestResultsData
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API $APIName -tenant $TenantFilter -message "Error retrieving tests: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        $StatusCode = [HttpStatusCode]::BadRequest
+        $Body = @{ Error = $ErrorMessage.NormalizedError }
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1
index ed347dc8dc35..3cdc003452d4 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecAppPermissionTemplate.ps1	
@@ -73,7 +73,6 @@ function Invoke-ExecAppPermissionTemplate {
             if ($Request.Query.TemplateId) {
                 $templateId = $Request.Query.TemplateId
                 $filter = "PartitionKey eq 'Templates' and RowKey eq '$templateId'"
-                Write-LogMessage -headers $Headers -API 'ExecAppPermissionTemplate' -message "Retrieved specific template: $templateId" -Sev 'Info'
             }
 
             $Body = Get-CIPPAzDataTableEntity @Table -Filter $filter | ForEach-Object {
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1
index 202377450790..9e02c588bf36 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Administration/Application Approval/Invoke-ExecCreateAppTemplate.ps1	
@@ -27,45 +27,107 @@ function Invoke-ExecCreateAppTemplate {
             throw 'DisplayName is required'
         }
 
+        # Build initial bulk request to get app registration and all service principals
+        # The SP we need will be in the splist, so we don't need a separate call
+        $InitialBulkRequests = @(
+            [PSCustomObject]@{
+                id     = 'app'
+                method = 'GET'
+                url    = "/applications(appId='$AppId')?`$select=id,appId,displayName,requiredResourceAccess"
+            }
+            [PSCustomObject]@{
+                id     = 'splist'
+                method = 'GET'
+                url    = '/servicePrincipals?$top=999&$select=id,appId,displayName'
+            }
+        )
+
+        Write-Information "Retrieving app details for AppId: $AppId in tenant: $TenantFilter"
+        $InitialResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests $InitialBulkRequests -NoAuthCheck $true -AsApp $true
+
+        $AppResult = $InitialResults | Where-Object { $_.id -eq 'app' } | Select-Object -First 1
+        $TenantInfo = ($InitialResults | Where-Object { $_.id -eq 'splist' }).body.value
+
+        # Find the specific service principal in the list
+        $SPResult = $TenantInfo | Where-Object { $_.appId -eq $AppId } | Select-Object -First 1
+
         # Get the app details based on type
         if ($Type -eq 'servicePrincipal') {
-            # For enterprise apps (service principals)
-            $AppDetails = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/servicePrincipals?`$filter=appId eq '$AppId'&`$select=id,appId,displayName,appRoles,oauth2PermissionScopes,requiredResourceAccess" -tenantid $TenantFilter
-
-            if (-not $AppDetails -or $AppDetails.Count -eq 0) {
+            if (-not $SPResult) {
                 throw "Service principal not found for AppId: $AppId"
             }
 
-            $App = $AppDetails[0]
+            $App = $SPResult
 
-            # Get the application registration to access requiredResourceAccess
-            try {
-                $AppRegistration = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/applications?`$filter=appId eq '$AppId'&`$select=id,appId,displayName,requiredResourceAccess" -tenantid $TenantFilter
-                if ($AppRegistration -and $AppRegistration.Count -gt 0) {
-                    $RequiredResourceAccess = $AppRegistration[0].requiredResourceAccess
-                } else {
-                    $RequiredResourceAccess = @()
+            # Check if we got the app registration and it has permissions
+            if ($AppResult.status -eq 200 -and $AppResult.body.requiredResourceAccess -and $AppResult.body.requiredResourceAccess.Count -gt 0) {
+                Write-LogMessage -headers $Request.headers -API $APINAME -message "Retrieved requiredResourceAccess from app registration for $AppId" -Sev 'Info'
+                $Permissions = $AppResult.body.requiredResourceAccess
+            } else {
+                # App registration not accessible or no permissions configured
+                # Build permissions from oauth2PermissionGrants and appRoleAssignments
+                Write-LogMessage -headers $Request.headers -API $APINAME -message "Could not retrieve app registration for $AppId - extracting from service principal grants and role assignments" -Sev 'Info'
+
+                # Bulk request to get grants and assignments
+                $GrantsBulkRequests = @(
+                    [PSCustomObject]@{
+                        id     = 'grants'
+                        method = 'GET'
+                        url    = "/servicePrincipals(appId='$AppId')/oauth2PermissionGrants"
+                    }
+                    [PSCustomObject]@{
+                        id     = 'assignments'
+                        method = 'GET'
+                        url    = "/servicePrincipals(appId='$AppId')/appRoleAssignments"
+                    }
+                )
+
+                $GrantsResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests $GrantsBulkRequests -NoAuthCheck $true -AsApp $true
+
+                $DelegatePermissionGrants = ($GrantsResults | Where-Object { $_.id -eq 'grants' }).body.value
+                $AppRoleAssignments = ($GrantsResults | Where-Object { $_.id -eq 'assignments' }).body.value
+
+                $DelegateResourceAccess = $DelegatePermissionGrants | Group-Object -Property resourceId | ForEach-Object {
+                    [pscustomobject]@{
+                        resourceAppId  = ($TenantInfo | Where-Object -Property id -EQ $_.Name).appId
+                        resourceAccess = @($_.Group | ForEach-Object {
+                                [pscustomobject]@{
+                                    id   = $_.scope
+                                    type = 'Scope'
+                                }
+                            })
+                    }
                 }
-            } catch {
-                Write-LogMessage -headers $Request.headers -API $APINAME -message "Could not retrieve app registration for $AppId - will extract from service principal" -Sev 'Warning'
-                $RequiredResourceAccess = @()
-            }
 
-            # Use requiredResourceAccess if available, otherwise we can't create a proper template
-            if ($RequiredResourceAccess -and $RequiredResourceAccess.Count -gt 0) {
-                $Permissions = $RequiredResourceAccess
-            } else {
-                # No permissions found - warn the user
-                Write-LogMessage -headers $Request.headers -API $APINAME -message "No permissions found for $AppId. The app registration may not have configured API permissions." -Sev 'Warning'
-                $Permissions = @()
+                $ApplicationResourceAccess = $AppRoleAssignments | Group-Object -Property ResourceId | ForEach-Object {
+                    [pscustomobject]@{
+                        resourceAppId  = ($TenantInfo | Where-Object -Property id -EQ $_.Name).appId
+                        resourceAccess = @($_.Group | ForEach-Object {
+                                [pscustomobject]@{
+                                    id   = $_.appRoleId
+                                    type = 'Role'
+                                }
+                            })
+                    }
+                }
+
+                # Combine both delegated and application permissions
+                $Permissions = @($DelegateResourceAccess) + @($ApplicationResourceAccess) | Where-Object { $_ -ne $null }
+
+                if ($Permissions.Count -eq 0) {
+                    Write-LogMessage -headers $Request.headers -API $APINAME -message "No permissions found for $AppId via any method" -Sev 'Warning'
+                } else {
+                    Write-LogMessage -headers $Request.headers -API $APINAME -message "Extracted $($Permissions.Count) resource permission(s) from service principal grants" -Sev 'Info'
+                }
             }
         } else {
             # For app registrations (applications)
-            $App = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$AppId')" -tenantid $TenantFilter
-            if (-not $App -or $App.Count -eq 0) {
+            if ($AppResult.status -ne 200 -or -not $AppResult.body) {
                 throw "App registration not found for AppId: $AppId"
             }
 
+            $App = $AppResult.body
+
             $Tenant = Get-Tenants -TenantFilter $TenantFilter
             if ($Tenant.customerId -ne $env:TenantID) {
                 $ExistingApp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=displayName eq '$DisplayName'" -tenantid $env:TenantID -NoAuthCheck $true -AsApp $true
@@ -136,7 +198,7 @@ function Invoke-ExecCreateAppTemplate {
                     $Body = @{
                         appId = $AppId
                     }
-                    $NewSP = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -tenantid $env:TenantID -NoAuthCheck $true -AsApp $true -type POST -body ($Body | ConvertTo-Json -Depth 10)
+                    $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -tenantid $env:TenantID -NoAuthCheck $true -AsApp $true -type POST -body ($Body | ConvertTo-Json -Depth 10)
                     Write-LogMessage -headers $Request.headers -API $APINAME -message "App Registration $($AppDetails.displayName) copied to partner tenant" -Sev 'Info'
                 }
             }
@@ -152,21 +214,87 @@ function Invoke-ExecCreateAppTemplate {
         $PermissionSetName = "$DisplayName (Auto-created)"
 
         if ($Permissions -and $Permissions.Count -gt 0) {
+            # Build bulk requests to get all service principals efficiently using object IDs from cached list
+            $BulkRequests = [System.Collections.Generic.List[object]]::new()
+            $RequestIndex = 0
+            $AppIdToRequestId = @{}
+
+            foreach ($Resource in $Permissions) {
+                $ResourceAppId = $Resource.resourceAppId
+
+                # Find the service principal object ID from the cached list
+                $ResourceSPInfo = $TenantInfo | Where-Object { $_.appId -eq $ResourceAppId } | Select-Object -First 1
+
+                if ($ResourceSPInfo) {
+                    $RequestId = "sp-$RequestIndex"
+                    $AppIdToRequestId[$ResourceAppId] = $RequestId
+
+                    # Use object ID to fetch full details with appRoles and oauth2PermissionScopes
+                    $BulkRequests.Add([PSCustomObject]@{
+                            id     = $RequestId
+                            method = 'GET'
+                            url    = "/servicePrincipals/$($ResourceSPInfo.id)?`$select=id,appId,displayName,appRoles,oauth2PermissionScopes"
+                        })
+                    $RequestIndex++
+                } else {
+                    Write-LogMessage -headers $Request.headers -API $APINAME -message "Service principal not found in tenant for appId: $ResourceAppId" -Sev 'Warning'
+                }
+            }
+
+            # Execute bulk request to get all service principals at once (only if we have requests)
+            if ($BulkRequests.Count -gt 0) {
+                Write-Information "Fetching $($BulkRequests.Count) service principal(s) via bulk request"
+                $BulkResults = New-GraphBulkRequest -tenantid $TenantFilter -Requests $BulkRequests -NoAuthCheck $true -AsApp $true
+
+                # Create lookup table for service principals by appId
+                $SPLookup = @{}
+                foreach ($Result in $BulkResults) {
+                    if ($Result.status -eq 200 -and $Result.body) {
+                        $SPLookup[$Result.body.appId] = $Result.body
+                    }
+                }
+            } else {
+                $SPLookup = @{}
+            }
+
+            # Now process permissions for each resource
             foreach ($Resource in $Permissions) {
                 $ResourceAppId = $Resource.resourceAppId
                 $AppPerms = [System.Collections.ArrayList]::new()
                 $DelegatedPerms = [System.Collections.ArrayList]::new()
 
-                foreach ($Access in $Resource.resourceAccess) {
-                    $PermObj = [PSCustomObject]@{
-                        id    = $Access.id
-                        value = $Access.id  # In the permission set format, both id and value are the permission ID
-                    }
+                $ResourceSP = $SPLookup[$ResourceAppId]
+
+                if (!$ResourceSP) {
+                    Write-LogMessage -headers $Request.headers -API $APINAME -message "Service principal not found for appId: $ResourceAppId - skipping permission translation" -Sev 'Warning'
+                    continue
+                }
 
+                foreach ($Access in $Resource.resourceAccess) {
                     if ($Access.type -eq 'Role') {
-                        [void]$AppPerms.Add($PermObj)
+                        # Look up application permission name from appRoles
+                        $AppRole = $ResourceSP.appRoles | Where-Object { $_.id -eq $Access.id } | Select-Object -First 1
+                        if ($AppRole) {
+                            $PermObj = [PSCustomObject]@{
+                                id    = $Access.id
+                                value = $AppRole.value  # Use the claim value name, not the GUID
+                            }
+                            [void]$AppPerms.Add($PermObj)
+                        } else {
+                            Write-LogMessage -headers $Request.headers -API $APINAME -message "Application permission $($Access.id) not found in $ResourceAppId appRoles" -Sev 'Warning'
+                        }
                     } elseif ($Access.type -eq 'Scope') {
-                        [void]$DelegatedPerms.Add($PermObj)
+                        # Look up delegated permission name from oauth2PermissionScopes
+                        $PermissionScope = $ResourceSP.oauth2PermissionScopes | Where-Object { $_.id -eq $Access.id } | Select-Object -First 1
+                        if ($PermissionScope) {
+                            $PermObj = [PSCustomObject]@{
+                                id    = $Access.id
+                                value = $PermissionScope.value  # Use the claim value name, not the GUID
+                            }
+                            [void]$DelegatedPerms.Add($PermObj)
+                        } else {
+                            Write-LogMessage -headers $Request.headers -API $APINAME -message "Delegated permission $($Access.id) not found in $ResourceAppId oauth2PermissionScopes" -Sev 'Warning'
+                        }
                     }
                 }
 
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1
index d2aaddf9a694..0b94eb63d919 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1	
@@ -53,13 +53,29 @@ function Invoke-ListStandardsCompare {
             $FieldValue = [string]$FieldValue
         }
 
+        # Parse CurrentValue and ExpectedValue from JSON if they are JSON strings
+        $ParsedCurrentValue = if ($Standard.CurrentValue -and (Test-Json -Json $Standard.CurrentValue -ErrorAction SilentlyContinue)) {
+            ConvertFrom-Json -InputObject $Standard.CurrentValue -ErrorAction SilentlyContinue
+        } else {
+            $Standard.CurrentValue
+        }
+
+        $ParsedExpectedValue = if ($Standard.ExpectedValue -and (Test-Json -Json $Standard.ExpectedValue -ErrorAction SilentlyContinue)) {
+            ConvertFrom-Json -InputObject $Standard.ExpectedValue -ErrorAction SilentlyContinue
+        } else {
+            $Standard.ExpectedValue
+        }
+
         if (-not $TenantStandards.ContainsKey($Tenant)) {
             $TenantStandards[$Tenant] = @{}
         }
         $TenantStandards[$Tenant][$FieldName] = @{
-            Value       = $FieldValue
-            LastRefresh = $Standard.TimeStamp.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
-            TemplateId  = $Standard.TemplateId
+            Value            = $FieldValue
+            LastRefresh      = $Standard.TimeStamp.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+            TemplateId       = $Standard.TemplateId
+            LicenseAvailable = $Standard.LicenseAvailable
+            CurrentValue     = $ParsedCurrentValue
+            ExpectedValue    = $ParsedExpectedValue
         }
     }
 
diff --git a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1 b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1
index cfd69a6fe214..d9d3f9e2dfc0 100644
--- a/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveStandardTemplate.ps1	
@@ -16,9 +16,13 @@ function Invoke-RemoveStandardTemplate {
     $ID = $Request.Body.ID ?? $Request.Query.ID
     try {
         $Table = Get-CippTable -tablename 'templates'
-        $Filter = "PartitionKey eq 'StandardsTemplateV2' and RowKey eq '$ID'"
+        $Filter = "PartitionKey eq 'StandardsTemplateV2' and GUID eq '$ID'"
         $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey, JSON
-        $TemplateName = (ConvertFrom-Json -InputObject $ClearRow.JSON).templateName
+        if ($ClearRow.JSON) {
+            $TemplateName = (ConvertFrom-Json -InputObject $ClearRow.JSON -ErrorAction SilentlyContinue).templateName
+        } else {
+            $TemplateName = ''
+        }
         Remove-AzDataTableEntity -Force @Table -Entity $ClearRow
         $Result = "Removed Standards Template named: '$($TemplateName)' with id: $($ID)"
         Write-LogMessage -Headers $Headers -API $APIName -message $Result -Sev Info
diff --git a/Modules/CIPPCore/Public/Entrypoints/Invoke-ExecUniversalSearch.ps1 b/Modules/CIPPCore/Public/Entrypoints/Invoke-ExecUniversalSearch.ps1
index 44f8009edea1..a984cada9ddc 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Invoke-ExecUniversalSearch.ps1
+++ b/Modules/CIPPCore/Public/Entrypoints/Invoke-ExecUniversalSearch.ps1
@@ -1,7 +1,7 @@
-Function Invoke-ExecUniversalSearch {
+function Invoke-ExecUniversalSearch {
     <#
     .FUNCTIONALITY
-        Entrypoint
+        Entrypoint,AnyTenant
     .ROLE
         CIPP.Core.Read
     #>
@@ -41,8 +41,8 @@ Function Invoke-ExecUniversalSearch {
         $GraphRequest = "Could not connect to Azure Lighthouse API: $($ErrorMessage)"
     }
     return [HttpResponseContext]@{
-            StatusCode = $StatusCode
-            Body       = @($GraphRequest)
-        }
+        StatusCode = $StatusCode
+        Body       = @($GraphRequest)
+    }
 
 }
diff --git a/Modules/CIPPCore/Public/Entrypoints/Invoke-ListLogs.ps1 b/Modules/CIPPCore/Public/Entrypoints/Invoke-ListLogs.ps1
index 92682df3bf50..dd504b9700e7 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Invoke-ListLogs.ps1
+++ b/Modules/CIPPCore/Public/Entrypoints/Invoke-ListLogs.ps1
@@ -92,12 +92,8 @@ function Invoke-ListLogs {
             $EndDate = $Request.Query.EndDate ?? $Request.Query.DateFilter
 
             if ($StartDate -and $EndDate) {
-                # Collect logs for each partition key date in range
-                $PartitionKeys = for ($Date = [datetime]::ParseExact($StartDate, 'yyyyMMdd', $null); $Date -le [datetime]::ParseExact($EndDate, 'yyyyMMdd', $null); $Date = $Date.AddDays(1)) {
-                    $PartitionKey = $Date.ToString('yyyyMMdd')
-                    "PartitionKey eq '$PartitionKey'"
-                }
-                $Filter = $PartitionKeys -join ' or '
+                # Collect logs for date range
+                $Filter = "PartitionKey ge '$StartDate' and PartitionKey le '$EndDate'"
             } elseif ($StartDate) {
                 $Filter = "PartitionKey eq '{0}'" -f $StartDate
             } else {
diff --git a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBCacheOrchestrator.ps1 b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBCacheOrchestrator.ps1
new file mode 100644
index 000000000000..51e0861ca294
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBCacheOrchestrator.ps1	
@@ -0,0 +1,60 @@
+function Start-CIPPDBCacheOrchestrator {
+    <#
+    .SYNOPSIS
+        Orchestrates database cache collection across all tenants
+
+    .DESCRIPTION
+        Creates per-tenant jobs to collect and cache Microsoft Graph data
+
+    .FUNCTIONALITY
+        Entrypoint
+    #>
+    [CmdletBinding()]
+    param()
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -message 'Starting database cache orchestration' -sev Info
+        Write-Host 'Starting database cache orchestration'
+        $TenantList = Get-Tenants | Where-Object { $_.defaultDomainName -ne $null }
+
+        if ($TenantList.Count -eq 0) {
+            Write-LogMessage -API 'CIPPDBCache' -message 'No tenants found for cache collection' -sev Warning
+            return
+        }
+
+        $TaskCount = $TenantList.Count * 2
+
+        $Queue = New-CippQueueEntry -Name 'Database Cache Collection' -TotalTasks $TaskCount
+        $Batch = [system.collections.generic.list[object]]::new()
+        foreach ($Tenant in $TenantList) {
+            $Batch.Add([PSCustomObject]@{
+                    FunctionName = 'CIPPDBCacheData'
+                    TenantFilter = $Tenant.defaultDomainName
+                    QueueId      = $Queue.RowKey
+                    QueueName    = "DB Cache - $($Tenant.defaultDomainName)"
+                })
+            $Batch.Add([PSCustomObject]@{
+                    FunctionName = 'CIPPDBCacheData'
+                    TenantFilter = $Tenant.defaultDomainName
+                    QueueId      = $Queue.RowKey
+                    Type         = 'Mailboxes'
+                    QueueName    = "DB Cache Mailboxes - $($Tenant.defaultDomainName)"
+                })
+        }
+        Write-Host "Created queue $($Queue.RowKey) for database cache collection of $($TenantList.Count) tenants"
+        Write-Host "Starting batch of $($Batch.Count) cache collection activities"
+        $InputObject = [PSCustomObject]@{
+            Batch            = @($Batch)
+            OrchestratorName = 'CIPPDBCacheOrchestrator'
+            SkipLog          = $false
+        }
+
+        Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Compress -Depth 5)
+
+        Write-LogMessage -API 'CIPPDBCache' -message "Queued database cache collection for $($TenantList.Count) tenants" -sev Info
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -message "Failed to start orchestration: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-TestsOrchestrator.ps1 b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-TestsOrchestrator.ps1
new file mode 100644
index 000000000000..da22c521107e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-TestsOrchestrator.ps1	
@@ -0,0 +1,16 @@
+function Start-TestsOrchestrator {
+    <#
+    .SYNOPSIS
+    Start the Tests Orchestrator
+
+    .FUNCTIONALITY
+    Entrypoint
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param()
+
+    if ($PSCmdlet.ShouldProcess('Start-TestsOrchestrator', 'Starting Tests Orchestrator')) {
+        Write-LogMessage -API 'Tests' -message 'Starting Tests Schedule' -sev Info
+        Invoke-CIPPTestsRun -TenantFilter 'allTenants'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1 b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1
index d635141637dc..272c78ee2627 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1	
@@ -10,8 +10,11 @@ function Start-UserTasksOrchestrator {
     param()
 
     $Table = Get-CippTable -tablename 'ScheduledTasks'
-    $1HourAgo = (Get-Date).AddHours(-1).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
-    $Filter = "PartitionKey eq 'ScheduledTask' and (TaskState eq 'Planned' or TaskState eq 'Failed - Planned' or (TaskState eq 'Running' and Timestamp lt datetime'$1HourAgo'))"
+    $30MinutesAgo = (Get-Date).AddMinutes(-30).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $4HoursAgo = (Get-Date).AddHours(-4).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    # Pending = orchestrator queued, Running = actively executing
+    # Pick up: Planned, Failed-Planned, stuck Pending (>30min), or stuck Running (>4hr for large AllTenants tasks)
+    $Filter = "PartitionKey eq 'ScheduledTask' and (TaskState eq 'Planned' or TaskState eq 'Failed - Planned' or (TaskState eq 'Pending' and Timestamp lt datetime'$30MinutesAgo') or (TaskState eq 'Running' and Timestamp lt datetime'$4HoursAgo'))"
     $tasks = Get-CIPPAzDataTableEntity @Table -Filter $Filter
 
     $RateLimitTable = Get-CIPPTable -tablename 'SchedulerRateLimits'
@@ -49,11 +52,14 @@ function Start-UserTasksOrchestrator {
         $currentUnixTime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
         if ($currentUnixTime -ge $task.ScheduledTime) {
             try {
+                # Update task state to 'Pending' immediately to prevent concurrent orchestrator runs from picking it up
+                # 'Pending' = orchestrator has picked it up and is queuing commands
+                # 'Running' = actual execution is happening (set by Push-ExecScheduledCommand)
                 $null = Update-AzDataTableEntity -Force @Table -Entity @{
                     PartitionKey = $task.PartitionKey
                     RowKey       = $task.RowKey
                     ExecutedTime = "$currentUnixTime"
-                    TaskState    = 'Planned'
+                    TaskState    = 'Pending'
                 }
                 $task.Parameters = $task.Parameters | ConvertFrom-Json -AsHashtable
                 $task.AdditionalProperties = $task.AdditionalProperties | ConvertFrom-Json
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1
index 9a70515884a4..ed00a0292aa1 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-BackupRetentionCleanup.ps1	
@@ -13,12 +13,12 @@ function Start-BackupRetentionCleanup {
         $ConfigTable = Get-CippTable -tablename Config
         $Filter = "PartitionKey eq 'BackupRetention' and RowKey eq 'Settings'"
         $RetentionSettings = Get-CIPPAzDataTableEntity @ConfigTable -Filter $Filter
-        
+
         # Default to 30 days if not set
-        $RetentionDays = if ($RetentionSettings.RetentionDays) { 
-            [int]$RetentionSettings.RetentionDays 
-        } else { 
-            30 
+        $RetentionDays = if ($RetentionSettings.RetentionDays) {
+            [int]$RetentionSettings.RetentionDays
+        } else {
+            30
         }
 
         # Ensure minimum retention of 7 days
@@ -27,24 +27,67 @@ function Start-BackupRetentionCleanup {
         }
 
         Write-Host "Starting backup cleanup with retention of $RetentionDays days"
-        
+
         # Calculate cutoff date
         $CutoffDate = (Get-Date).AddDays(-$RetentionDays).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
-        
+
         $DeletedCounts = [System.Collections.Generic.List[int]]::new()
 
         # Clean up CIPP Backups
         if ($PSCmdlet.ShouldProcess('CIPPBackup', 'Cleaning up old backups')) {
             $CIPPBackupTable = Get-CippTable -tablename 'CIPPBackup'
-            $Filter = "PartitionKey eq 'CIPPBackup' and Timestamp lt datetime'$CutoffDate'"
-            
-            $OldCIPPBackups = Get-AzDataTableEntity @CIPPBackupTable -Filter $Filter -Property @('PartitionKey', 'RowKey', 'ETag')
-            
-            if ($OldCIPPBackups) {
-                Write-Host "Found $($OldCIPPBackups.Count) old CIPP backups to delete"
-                Remove-AzDataTableEntity @CIPPBackupTable -Entity $OldCIPPBackups -Force
-                $DeletedCounts.Add($OldCIPPBackups.Count)
-                Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $($OldCIPPBackups.Count) old CIPP backups" -Sev 'Info'
+            $CutoffFilter = "PartitionKey eq 'CIPPBackup' and Timestamp lt datetime'$CutoffDate'"
+
+            # Delete blob files
+            $BlobFilter = "$CutoffFilter and BackupIsBlob eq true"
+            $BlobBackups = Get-AzDataTableEntity @CIPPBackupTable -Filter $BlobFilter -Property @('PartitionKey', 'RowKey', 'Backup')
+
+            $BlobDeletedCount = 0
+            if ($BlobBackups) {
+                foreach ($Backup in $BlobBackups) {
+                    if ($Backup.Backup) {
+                        try {
+                            $BlobPath = $Backup.Backup
+                            # Extract container/blob path from URL
+                            if ($BlobPath -like '*:10000/*') {
+                                # Azurite format: http://host:10000/devstoreaccount1/container/blob
+                                $parts = $BlobPath -split ':10000/'
+                                if ($parts.Count -gt 1) {
+                                    # Remove account name to get container/blob
+                                    $BlobPath = ($parts[1] -split '/', 2)[-1]
+                                }
+                            } elseif ($BlobPath -like '*blob.core.windows.net/*') {
+                                # Azure Storage format: https://account.blob.core.windows.net/container/blob
+                                $BlobPath = ($BlobPath -split '.blob.core.windows.net/', 2)[-1]
+                            }
+                            $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $BlobPath -Method 'DELETE' -ConnectionString $ConnectionString
+                            $BlobDeletedCount++
+                            Write-Host "Deleted blob: $BlobPath"
+                        } catch {
+                            Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to delete blob $($Backup.Backup): $($_.Exception.Message)" -Sev 'Warning'
+                        }
+                    }
+                }
+                # Delete blob table entities
+                Remove-AzDataTableEntity @CIPPBackupTable -Entity $BlobBackups -Force
+            }
+
+            # Delete table-only backups (no blobs)
+            # Fetch all old entries and filter out blob entries client-side (null check is unreliable in filters)
+            $AllOldBackups = Get-AzDataTableEntity @CIPPBackupTable -Filter $CutoffFilter -Property @('PartitionKey', 'RowKey', 'ETag', 'BackupIsBlob')
+            $TableBackups = $AllOldBackups | Where-Object { $_.BackupIsBlob -ne $true }
+
+            $TableDeletedCount = 0
+            if ($TableBackups) {
+                Remove-AzDataTableEntity @CIPPBackupTable -Entity $TableBackups -Force
+                $TableDeletedCount = ($TableBackups | Measure-Object).Count
+            }
+
+            $TotalDeleted = $BlobDeletedCount + $TableDeletedCount
+            if ($TotalDeleted -gt 0) {
+                $DeletedCounts.Add($TotalDeleted)
+                Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $TotalDeleted old CIPP backups ($BlobDeletedCount blobs, $TableDeletedCount table entries)" -Sev 'Info'
+                Write-Host "Deleted $TotalDeleted old CIPP backups"
             } else {
                 Write-Host 'No old CIPP backups found'
             }
@@ -53,15 +96,58 @@ function Start-BackupRetentionCleanup {
         # Clean up Scheduled/Tenant Backups
         if ($PSCmdlet.ShouldProcess('ScheduledBackup', 'Cleaning up old backups')) {
             $ScheduledBackupTable = Get-CippTable -tablename 'ScheduledBackup'
-            $Filter = "PartitionKey eq 'ScheduledBackup' and Timestamp lt datetime'$CutoffDate'"
-            
-            $OldScheduledBackups = Get-AzDataTableEntity @ScheduledBackupTable -Filter $Filter -Property @('PartitionKey', 'RowKey', 'ETag')
-            
-            if ($OldScheduledBackups) {
-                Write-Host "Found $($OldScheduledBackups.Count) old tenant backups to delete"
-                Remove-AzDataTableEntity @ScheduledBackupTable -Entity $OldScheduledBackups -Force
-                $DeletedCounts.Add($OldScheduledBackups.Count)
-                Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $($OldScheduledBackups.Count) old tenant backups" -Sev 'Info'
+            $CutoffFilter = "PartitionKey eq 'ScheduledBackup' and Timestamp lt datetime'$CutoffDate'"
+
+            # Delete blob files
+            $BlobFilter = "$CutoffFilter and BackupIsBlob eq true"
+            $BlobBackups = Get-AzDataTableEntity @ScheduledBackupTable -Filter $BlobFilter -Property @('PartitionKey', 'RowKey', 'Backup')
+
+            $BlobDeletedCount = 0
+            if ($BlobBackups) {
+                foreach ($Backup in $BlobBackups) {
+                    if ($Backup.Backup) {
+                        try {
+                            $BlobPath = $Backup.Backup
+                            # Extract container/blob path from URL
+                            if ($BlobPath -like '*:10000/*') {
+                                # Azurite format: http://host:10000/devstoreaccount1/container/blob
+                                $parts = $BlobPath -split ':10000/'
+                                if ($parts.Count -gt 1) {
+                                    # Remove account name to get container/blob
+                                    $BlobPath = ($parts[1] -split '/', 2)[-1]
+                                }
+                            } elseif ($BlobPath -like '*blob.core.windows.net/*') {
+                                # Azure Storage format: https://account.blob.core.windows.net/container/blob
+                                $BlobPath = ($BlobPath -split '.blob.core.windows.net/', 2)[-1]
+                            }
+                            $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $BlobPath -Method 'DELETE' -ConnectionString $ConnectionString
+                            $BlobDeletedCount++
+                            Write-Host "Deleted blob: $BlobPath"
+                        } catch {
+                            Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to delete blob $($Backup.Backup): $($_.Exception.Message)" -Sev 'Warning'
+                        }
+                    }
+                }
+                # Delete blob table entities
+                Remove-AzDataTableEntity @ScheduledBackupTable -Entity $BlobBackups -Force
+            }
+
+            # Delete table-only backups (no blobs)
+            # Fetch all old entries and filter out blob entries client-side (null check is unreliable in filters)
+            $AllOldBackups = Get-AzDataTableEntity @ScheduledBackupTable -Filter $CutoffFilter -Property @('PartitionKey', 'RowKey', 'ETag', 'BackupIsBlob')
+            $TableBackups = $AllOldBackups | Where-Object { $_.BackupIsBlob -ne $true }
+
+            $TableDeletedCount = 0
+            if ($TableBackups) {
+                Remove-AzDataTableEntity @ScheduledBackupTable -Entity $TableBackups -Force
+                $TableDeletedCount = ($TableBackups | Measure-Object).Count
+            }
+
+            $TotalDeleted = $BlobDeletedCount + $TableDeletedCount
+            if ($TotalDeleted -gt 0) {
+                $DeletedCounts.Add($TotalDeleted)
+                Write-LogMessage -API 'BackupRetentionCleanup' -message "Deleted $TotalDeleted old tenant backups ($BlobDeletedCount blobs, $TableDeletedCount table entries)" -Sev 'Info'
+                Write-Host "Deleted $TotalDeleted old tenant backups"
             } else {
                 Write-Host 'No old tenant backups found'
             }
@@ -69,7 +155,7 @@ function Start-BackupRetentionCleanup {
 
         $TotalDeleted = ($DeletedCounts | Measure-Object -Sum).Sum
         Write-LogMessage -API 'BackupRetentionCleanup' -message "Backup cleanup completed. Total backups deleted: $TotalDeleted (retention: $RetentionDays days)" -Sev 'Info'
-        
+
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'BackupRetentionCleanup' -message "Failed to run backup cleanup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1
index e8d56975c448..e4060f1c0a37 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1	
@@ -43,7 +43,12 @@ function Start-CIPPStatsTimer {
             CFZTNA              = $RawExt.CFZTNA.Enabled
             GitHub              = $RawExt.GitHub.Enabled
         } | ConvertTo-Json
-
-        Invoke-RestMethod -Uri 'https://management.cipp.app/api/stats' -Method POST -Body $SendingObject -ContentType 'application/json'
+        try {
+            Invoke-RestMethod -Uri 'https://management.cipp.app/api/stats' -Method POST -Body $SendingObject -ContentType 'application/json'
+        } catch {
+            $rand = Get-Random -Minimum 0.5 -Maximum 5.5
+            Start-Sleep -Seconds $rand
+            Invoke-RestMethod -Uri 'https://management.cipp.app/api/stats' -Method POST -Body $SendingObject -ContentType 'application/json'
+        }
     }
 }
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1
index 64e175b72e8c..5987188d5a10 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1	
@@ -19,7 +19,6 @@ function Start-DurableCleanup {
     )
 
     $WarningPreference = 'SilentlyContinue'
-    $StorageContext = New-AzStorageContext -ConnectionString $env:AzureWebJobsStorage
     $TargetTime = (Get-Date).ToUniversalTime().AddSeconds(-$MaxDuration)
     $Context = New-AzDataTableContext -ConnectionString $env:AzureWebJobsStorage
     $InstancesTables = Get-AzDataTable -Context $Context | Where-Object { $_ -match 'Instances' }
@@ -34,7 +33,7 @@ function Start-DurableCleanup {
         $Table = Get-CippTable -TableName $Table
         $FunctionName = $Table.TableName -replace 'Instances', ''
         $Orchestrators = Get-CIPPAzDataTableEntity @Table -Filter "RuntimeStatus eq 'Running'" | Select-Object * -ExcludeProperty Input
-        $Queues = Get-AzStorageQueue -Context $StorageContext -Name ('{0}*' -f $FunctionName) | Select-Object -Property Name, ApproximateMessageCount, QueueClient
+        $Queues = Get-CIPPAzStorageQueue -Name ('{0}*' -f $FunctionName) | Select-Object -Property Name, ApproximateMessageCount, QueueClient
         $LongRunningOrchestrators = $Orchestrators | Where-Object { $_.CreatedTime.DateTime -lt $TargetTime }
 
         if ($LongRunningOrchestrators.Count -gt 0) {
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1
index 177e67cdb378..4989829ba7a9 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1	
@@ -3,7 +3,6 @@ function Start-TableCleanup {
     .SYNOPSIS
     Start the Table Cleanup Timer
     #>
-    [CmdletBinding(SupportsShouldProcess = $true)]
     param()
 
     $Batch = @(
@@ -60,7 +59,7 @@ function Start-TableCleanup {
         @{
             FunctionName = 'TableCleanupTask'
             Type         = 'DeleteTable'
-            Tables       = @('knownlocationdb')
+            Tables       = @('knownlocationdb', 'CacheExtensionSync', 'ExtensionSync')
         }
     )
 
diff --git a/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1 b/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1
index cb81201cfc29..a2a6553fb250 100644
--- a/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1
+++ b/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1
@@ -86,12 +86,15 @@ function Get-CIPPTenantAlignment {
                 }
             }
 
-            if (-not $tenantData.ContainsKey($Tenant)) {
+            if ($Tenant -and -not $tenantData.ContainsKey($Tenant)) {
                 $tenantData[$Tenant] = @{}
             }
             $tenantData[$Tenant][$FieldName] = @{
-                Value       = $FieldValue
-                LastRefresh = $Standard.TimeStamp.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+                Value            = $FieldValue
+                LastRefresh      = $Standard.TimeStamp.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+                LicenseAvailable = $Standard.LicenseAvailable
+                CurrentValue     = $Standard.CurrentValue
+                ExpectedValue    = $Standard.ExpectedValue
             }
         }
         $TenantStandards = $tenantData
@@ -125,13 +128,14 @@ function Get-CIPPTenantAlignment {
                         $TenantValues.Add($filterItem.value)
                     }
                 }
-
-                if ($TenantValues -contains 'AllTenants') {
+`
+                    if ($TenantValues -contains 'AllTenants') {
                     $AppliestoAllTenants = $true
                 } elseif ($TenantValues.Count -gt 0) {
                     $TemplateAssignedTenants = @($TenantValues)
                 } else {
-                    $TemplateAssignedTenants = @()
+                    # Filter was specified but resolved to no tenants (empty group) - skip this template
+                    continue
                 }
             } else {
                 $AppliestoAllTenants = $true
@@ -174,7 +178,7 @@ function Get-CIPPTenantAlignment {
                                 $IntuneActions = if ($IntuneTemplate.action) { $IntuneTemplate.action } else { @() }
                                 $IntuneReportingEnabled = ($IntuneActions | Where-Object { $_.value -and ($_.value.ToLower() -eq 'report' -or $_.value.ToLower() -eq 'remediate') }).Count -gt 0
                                 $TagTemplate = $TagTemplates | Where-Object -Property package -EQ $Tag.value
-                                $TagTemplates | ForEach-Object {
+                                $TagTemplate | ForEach-Object {
                                     $TagStandardId = "standards.IntuneTemplate.$($_.GUID)"
                                     [PSCustomObject]@{
                                         StandardId       = $TagStandardId
@@ -241,7 +245,8 @@ function Get-CIPPTenantAlignment {
                     # Use HashSet for Contains
                     $IsReportingDisabled = $ReportingDisabledSet.Contains($StandardKey)
                     # Use cached tenant data
-                    $HasStandard = $CurrentTenantStandards.ContainsKey($StandardKey)
+
+                    $HasStandard = $StandardKey -and $CurrentTenantStandards.ContainsKey($StandardKey)
 
                     if ($HasStandard) {
                         $StandardObject = $CurrentTenantStandards[$StandardKey]
@@ -254,7 +259,7 @@ function Get-CIPPTenantAlignment {
                             }
                         }
 
-                        $IsCompliant = ($Value -eq $true)
+                        $IsCompliant = ($Value -eq $true) -or ($StandardObject.CurrentValue -and $StandardObject.CurrentValue -eq $StandardObject.ExpectedValue)
                         $IsLicenseMissing = ($Value -is [string] -and $Value -like 'License Missing:*')
 
                         $ComplianceStatus = if ($IsReportingDisabled) {
@@ -275,6 +280,9 @@ function Get-CIPPTenantAlignment {
                                 StandardValue     = $StandardValueJson
                                 ComplianceStatus  = $ComplianceStatus
                                 ReportingDisabled = $IsReportingDisabled
+                                LicenseAvailable  = $StandardObject.LicenseAvailable
+                                CurrentValue      = $StandardObject.CurrentValue
+                                ExpectedValue     = $StandardObject.ExpectedValue
                             })
                     } else {
                         $ComplianceStatus = if ($IsReportingDisabled) {
@@ -289,6 +297,9 @@ function Get-CIPPTenantAlignment {
                                 StandardValue     = 'NOT FOUND'
                                 ComplianceStatus  = $ComplianceStatus
                                 ReportingDisabled = $IsReportingDisabled
+                                LicenseAvailable  = $null
+                                CurrentValue      = $null
+                                ExpectedValue     = $null
                             })
                     }
                 }
diff --git a/Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1 b/Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1
index b0bec0aee247..851822afe56c 100644
--- a/Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1
+++ b/Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1
@@ -46,7 +46,7 @@ function Test-CIPPStandardLicense {
         if ($Capabilities.Count -le 0) {
             if (!$SkipLog.IsPresent) {
                 Write-LogMessage -API 'Standards' -tenant $TenantFilter -message "Tenant does not have the required capability to run standard $StandardName`: The tenant needs one of the following service plans: $($RequiredCapabilities -join ',')" -sev Info
-                Set-CIPPStandardsCompareField -FieldName "standards.$StandardName" -FieldValue "License Missing: This tenant is not licensed for the following capabilities: $($RequiredCapabilities -join ',')" -Tenant $TenantFilter
+                Set-CIPPStandardsCompareField -FieldName "standards.$StandardName" -LicenseAvailable $false -FieldValue "License Missing: This tenant is not licensed for the following capabilities: $($RequiredCapabilities -join ',')" -Tenant $TenantFilter
                 Write-Verbose "Tenant does not have the required capability to run standard $StandardName - $($RequiredCapabilities -join ','). Exiting"
             }
             return $false
diff --git a/Modules/CIPPCore/Public/Get-CIPPBackup.ps1 b/Modules/CIPPCore/Public/Get-CIPPBackup.ps1
index 4c714188f3c4..4ce3d174b30a 100644
--- a/Modules/CIPPCore/Public/Get-CIPPBackup.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPBackup.ps1
@@ -18,7 +18,15 @@ function Get-CIPPBackup {
     }
 
     if ($NameOnly.IsPresent) {
-        $Table.Property = @('RowKey')
+        if ($Type -ne 'Scheduled') {
+            $Table.Property = @('RowKey', 'Timestamp', 'BackupIsBlob')
+        } else {
+            $Table.Property = @('RowKey', 'Timestamp')
+        }
+    }
+
+    if ($TenantFilter -and $TenantFilter -ne 'AllTenants') {
+        $Conditions.Add("RowKey gt '$($TenantFilter)' and RowKey lt '$($TenantFilter)~'")
     }
 
     $Filter = $Conditions -join ' and '
@@ -27,13 +35,60 @@ function Get-CIPPBackup {
 
     if ($NameOnly.IsPresent) {
         $Info = $Info | Where-Object { $_.RowKey -notmatch '-part[0-9]+$' }
-        if ($TenantFilter) {
-            $Info = $Info | Where-Object { $_.RowKey -match "^$($TenantFilter)_" }
-        }
     } else {
         if ($TenantFilter -and $TenantFilter -ne 'AllTenants') {
             $Info = $Info | Where-Object { $_.TenantFilter -eq $TenantFilter }
         }
     }
+
+    # Augment results with blob-link awareness and fetch blob content when needed
+    if (-not $NameOnly.IsPresent -and $Info) {
+        foreach ($item in $Info) {
+            $isBlobLink = $false
+            $blobPath = $null
+            if ($null -ne $item.PSObject.Properties['Backup']) {
+                $b = $item.Backup
+                if ($b -is [string] -and ($b -like 'https://*' -or $b -like 'http://*')) {
+                    $isBlobLink = $true
+                    $blobPath = $b
+
+                    # Fetch the actual backup content from blob storage
+                    try {
+                        # Extract container/blob path from URL
+                        $resourcePath = $blobPath
+                        if ($resourcePath -like '*:10000/*') {
+                            # Azurite format: http://host:10000/devstoreaccount1/container/blob
+                            $parts = $resourcePath -split ':10000/'
+                            if ($parts.Count -gt 1) {
+                                # Remove account name to get container/blob
+                                $resourcePath = ($parts[1] -split '/', 2)[-1]
+                            }
+                        } elseif ($resourcePath -like '*blob.core.windows.net/*') {
+                            # Azure Storage format: https://account.blob.core.windows.net/container/blob
+                            $resourcePath = ($resourcePath -split '.blob.core.windows.net/', 2)[-1]
+                        }
+
+                        # Download the blob content
+                        $ConnectionString = $env:AzureWebJobsStorage
+                        $blobResponse = New-CIPPAzStorageRequest -Service 'blob' -Resource $resourcePath -Method 'GET' -ConnectionString $ConnectionString
+
+                        if ($blobResponse -and $blobResponse.Bytes) {
+                            $backupContent = [System.Text.Encoding]::UTF8.GetString($blobResponse.Bytes)
+                            # Replace the URL with the actual backup content
+                            $item.Backup = $backupContent
+                            Write-Verbose "Successfully retrieved backup content from blob storage for $($item.RowKey)"
+                        } else {
+                            Write-Warning "Failed to retrieve backup content from blob storage for $($item.RowKey)"
+                        }
+                    } catch {
+                        Write-Warning "Error fetching backup from blob storage: $($_.Exception.Message)"
+                        # Leave the URL in place if we can't fetch the content
+                    }
+                }
+            }
+            $item | Add-Member -NotePropertyName 'BackupIsBlobLink' -NotePropertyValue $isBlobLink -Force
+            $item | Add-Member -NotePropertyName 'BlobResourcePath' -NotePropertyValue $blobPath -Force
+        }
+    }
     return $Info
 }
diff --git a/Modules/CIPPCore/Public/Get-CIPPDbItem.ps1 b/Modules/CIPPCore/Public/Get-CIPPDbItem.ps1
new file mode 100644
index 000000000000..13924c6794d0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPDbItem.ps1
@@ -0,0 +1,69 @@
+function Get-CIPPDbItem {
+    <#
+    .SYNOPSIS
+        Get specific items from the CIPP Reporting database
+
+    .DESCRIPTION
+        Retrieves items from the CippReportingDB table using partition key (tenant) and type
+
+    .PARAMETER TenantFilter
+        The tenant domain or GUID (partition key)
+
+    .PARAMETER Type
+        The type of data to retrieve (used in row key filter)
+
+    .PARAMETER CountsOnly
+        If specified, returns all count rows for the tenant
+
+    .EXAMPLE
+        Get-CIPPDbItem -TenantFilter 'contoso.onmicrosoft.com' -Type 'Groups'
+
+    .EXAMPLE
+        Get-CIPPDbItem -TenantFilter 'contoso.onmicrosoft.com' -CountsOnly
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Type,
+
+        [Parameter(Mandatory = $false)]
+        [switch]$CountsOnly
+    )
+
+    try {
+        $Table = Get-CippTable -tablename 'CippReportingDB'
+
+        if ($CountsOnly) {
+            $Conditions = [System.Collections.Generic.List[string]]::new()
+            if ($TenantFilter -ne 'allTenants') {
+                $Conditions.Add("PartitionKey eq '{0}'" -f $TenantFilter)
+            }
+            if ($Type) {
+                $Conditions.Add("RowKey ge '{0}-' and RowKey lt '{0}.'" -f $Type)
+            }
+            $Filter = [string]::Join(' and ', $Conditions)
+            $Results = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property 'PartitionKey', 'RowKey', 'DataCount', 'Timestamp'
+            $Results = $Results | Where-Object { $_.RowKey -like '*-Count' } | Select-Object PartitionKey, RowKey, DataCount, Timestamp
+        } else {
+            if (-not $Type) {
+                throw 'Type parameter is required when CountsOnly is not specified'
+            }
+            if ($TenantFilter -ne 'allTenants') {
+                $Filter = "PartitionKey eq '{0}' and RowKey ge '{1}-' and RowKey lt '{1}.'" -f $TenantFilter, $Type
+            } else {
+                $Filter = "RowKey ge '{0}-' and RowKey lt '{0}.'" -f $Type
+            }
+            $Results = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+        }
+
+        return $Results
+
+    } catch {
+        Write-LogMessage -API 'CIPPDbItem' -tenant $TenantFilter -message "Failed to get items$(if ($Type) { " of type $Type" })$(if ($CountsOnly) { ' (counts only)' }): $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
+
diff --git a/Modules/CIPPCore/Public/Get-CIPPDrift.ps1 b/Modules/CIPPCore/Public/Get-CIPPDrift.ps1
index b93b683b67cd..bca1388b5b65 100644
--- a/Modules/CIPPCore/Public/Get-CIPPDrift.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPDrift.ps1
@@ -32,37 +32,36 @@ function Get-CIPPDrift {
     $IntuneCapable = Test-CIPPStandardLicense -StandardName 'IntuneTemplate_general' -TenantFilter $TenantFilter -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1')
     $ConditionalAccessCapable = Test-CIPPStandardLicense -StandardName 'ConditionalAccessTemplate_general' -TenantFilter $TenantFilter -RequiredCapabilities @('AAD_PREMIUM', 'AAD_PREMIUM_P2')
     $IntuneTable = Get-CippTable -tablename 'templates'
-    if ($IntuneCapable) {
-        $IntuneFilter = "PartitionKey eq 'IntuneTemplate'"
-        $RawIntuneTemplates = (Get-CIPPAzDataTableEntity @IntuneTable -Filter $IntuneFilter)
-        $AllIntuneTemplates = $RawIntuneTemplates | ForEach-Object {
-            try {
-                $JSONData = $_.JSON | ConvertFrom-Json -Depth 10 -ErrorAction SilentlyContinue
-                $data = $JSONData.RAWJson | ConvertFrom-Json -Depth 10 -ErrorAction SilentlyContinue
-                $data | Add-Member -NotePropertyName 'displayName' -NotePropertyValue $JSONData.Displayname -Force
-                $data | Add-Member -NotePropertyName 'description' -NotePropertyValue $JSONData.Description -Force
-                $data | Add-Member -NotePropertyName 'Type' -NotePropertyValue $JSONData.Type -Force
-                $data | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $_.RowKey -Force
-                $data
-            } catch {
-                # Skip invalid templates
-            }
-        } | Sort-Object -Property displayName
-    }
+
+    # Always load templates for display name resolution, even if tenant doesn't have licenses
+    $IntuneFilter = "PartitionKey eq 'IntuneTemplate'"
+    $RawIntuneTemplates = (Get-CIPPAzDataTableEntity @IntuneTable -Filter $IntuneFilter)
+    $AllIntuneTemplates = $RawIntuneTemplates | ForEach-Object {
+        try {
+            $JSONData = $_.JSON | ConvertFrom-Json -Depth 10 -ErrorAction SilentlyContinue
+            $data = $JSONData.RAWJson | ConvertFrom-Json -Depth 10 -ErrorAction SilentlyContinue
+            $data | Add-Member -NotePropertyName 'displayName' -NotePropertyValue $JSONData.Displayname -Force
+            $data | Add-Member -NotePropertyName 'description' -NotePropertyValue $JSONData.Description -Force
+            $data | Add-Member -NotePropertyName 'Type' -NotePropertyValue $JSONData.Type -Force
+            $data | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $_.RowKey -Force
+            $data
+        } catch {
+            # Skip invalid templates
+        }
+    } | Sort-Object -Property displayName
+
     # Load all CA templates
-    if ($ConditionalAccessCapable) {
-        $CAFilter = "PartitionKey eq 'CATemplate'"
-        $RawCATemplates = (Get-CIPPAzDataTableEntity @IntuneTable -Filter $CAFilter)
-        $AllCATemplates = $RawCATemplates | ForEach-Object {
-            try {
-                $data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue
-                $data | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $_.RowKey -Force
-                $data
-            } catch {
-                # Skip invalid templates
-            }
-        } | Sort-Object -Property displayName
-    }
+    $CAFilter = "PartitionKey eq 'CATemplate'"
+    $RawCATemplates = (Get-CIPPAzDataTableEntity @IntuneTable -Filter $CAFilter)
+    $AllCATemplates = $RawCATemplates | ForEach-Object {
+        try {
+            $data = $_.JSON | ConvertFrom-Json -Depth 100 -ErrorAction SilentlyContinue
+            $data | Add-Member -NotePropertyName 'GUID' -NotePropertyValue $_.RowKey -Force
+            $data
+        } catch {
+            # Skip invalid templates
+        }
+    } | Sort-Object -Property displayName
 
     try {
         $AlignmentData = Get-CIPPTenantAlignment -TenantFilter $TenantFilter -TemplateId $TemplateId | Where-Object -Property standardType -EQ 'drift'
@@ -103,24 +102,30 @@ function Get-CIPPDrift {
                         # Reset displayName and description for each deviation to prevent carryover from previous iterations
                         $displayName = $null
                         $standardDescription = $null
-                        #if the $ComparisonItem.StandardName contains *intuneTemplate*, then it's an Intune policy deviation, and we need to grab the correct displayname from the template table
-                        if ($ComparisonItem.StandardName -like '*intuneTemplate*') {
-                            $CompareGuid = $ComparisonItem.StandardName.Split('.') | Select-Object -Index 2
-                            Write-Verbose "Extracted GUID: $CompareGuid"
+                        #if the $ComparisonItem.StandardName contains *IntuneTemplate*, then it's an Intune policy deviation, and we need to grab the correct displayname from the template table
+                        if ($ComparisonItem.StandardName -like '*IntuneTemplate*') {
+                            $CompareGuid = $ComparisonItem.StandardName.Split('.') | Select-Object -Last 1
+                            Write-Verbose "Extracted Intune GUID: $CompareGuid from $($ComparisonItem.StandardName)"
                             $Template = $AllIntuneTemplates | Where-Object { $_.GUID -eq "$CompareGuid" }
                             if ($Template) {
                                 $displayName = $Template.displayName
                                 $standardDescription = $Template.description
+                                Write-Verbose "Found Intune template: $displayName"
+                            } else {
+                                Write-Warning "Intune template not found for GUID: $CompareGuid"
                             }
                         }
                         # Handle Conditional Access templates
                         if ($ComparisonItem.StandardName -like '*ConditionalAccessTemplate*') {
-                            $CompareGuid = $ComparisonItem.StandardName.Split('.') | Select-Object -Index 2
-                            Write-Verbose "Extracted CA GUID: $CompareGuid"
+                            $CompareGuid = $ComparisonItem.StandardName.Split('.') | Select-Object -Last 1
+                            Write-Verbose "Extracted CA GUID: $CompareGuid from $($ComparisonItem.StandardName)"
                             $Template = $AllCATemplates | Where-Object { $_.GUID -eq "$CompareGuid" }
                             if ($Template) {
                                 $displayName = $Template.displayName
                                 $standardDescription = $Template.description
+                                Write-Verbose "Found CA template: $displayName"
+                            } else {
+                                Write-Warning "CA template not found for GUID: $CompareGuid"
                             }
                         }
                         $reason = if ($ExistingDriftStates.ContainsKey($ComparisonItem.StandardName)) { $ExistingDriftStates[$ComparisonItem.StandardName].Reason }
@@ -129,12 +134,14 @@ function Get-CIPPDrift {
                                 standardName        = $ComparisonItem.StandardName
                                 standardDisplayName = $displayName
                                 standardDescription = $standardDescription
-                                expectedValue       = 'Compliant'
                                 receivedValue       = $ComparisonItem.StandardValue
                                 state               = 'current'
                                 Status              = $Status
                                 Reason              = $reason
                                 lastChangedByUser   = $User
+                                LicenseAvailable    = $ComparisonItem.LicenseAvailable
+                                CurrentValue        = $ComparisonItem.CurrentValue
+                                ExpectedValue       = $ComparisonItem.ExpectedValue
                             })
                     }
                 }
@@ -230,7 +237,17 @@ function Get-CIPPDrift {
 
             if ($Alignment.standardSettings) {
                 if ($Alignment.standardSettings.IntuneTemplate) {
-                    $IntuneTemplateIds = $Alignment.standardSettings.IntuneTemplate.TemplateList | ForEach-Object { $_.value }
+                    $IntuneTemplateIds = [System.Collections.Generic.List[string]]::new()
+                    foreach ($Template in $Alignment.standardSettings.IntuneTemplate) {
+                        if ($Template.TemplateList.value) {
+                            $IntuneTemplateIds.Add($Template.TemplateList.value)
+                        }
+                        if ($Template.'TemplateList-Tags'.rawData.templates) {
+                            foreach ($TagTemplate in $Template.'TemplateList-Tags'.rawData.templates) {
+                                $IntuneTemplateIds.Add($TagTemplate.GUID)
+                            }
+                        }
+                    }
                 }
                 if ($Alignment.standardSettings.ConditionalAccessTemplate) {
                     $CATemplateIds = $Alignment.standardSettings.ConditionalAccessTemplate.TemplateList | ForEach-Object { $_.value }
@@ -286,7 +303,7 @@ function Get-CIPPDrift {
                         standardName        = $PolicyKey
                         standardDisplayName = "Intune - $TenantPolicyName"
                         expectedValue       = 'This policy only exists in the tenant, not in the template.'
-                        receivedValue       = $TenantPolicy.Policy
+                        receivedValue       = ($TenantPolicy.Policy | ConvertTo-Json -Depth 10 -Compress)
                         state               = 'current'
                         Status              = $Status
                         Reason              = $reason
diff --git a/Modules/CIPPCore/Public/Get-CIPPMFAState.ps1 b/Modules/CIPPCore/Public/Get-CIPPMFAState.ps1
index 651261d3bdfb..1f16664f1da3 100644
--- a/Modules/CIPPCore/Public/Get-CIPPMFAState.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPMFAState.ps1
@@ -1,4 +1,3 @@
-
 function Get-CIPPMFAState {
     [CmdletBinding()]
     param (
@@ -10,7 +9,7 @@ function Get-CIPPMFAState {
     $users = foreach ($user in (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/users?$top=999&$select=id,UserPrincipalName,DisplayName,accountEnabled,assignedLicenses,perUserMfaState' -tenantid $TenantFilter)) {
         [PSCustomObject]@{
             UserPrincipalName = $user.UserPrincipalName
-            isLicensed        = [boolean]$user.assignedLicenses.skuid
+            isLicensed        = [boolean]$user.assignedLicenses.Count
             accountEnabled    = $user.accountEnabled
             DisplayName       = $user.DisplayName
             ObjectId          = $user.id
@@ -27,8 +26,12 @@ function Get-CIPPMFAState {
     }
     $CAState = [System.Collections.Generic.List[object]]::new()
 
-    Try {
-        $MFARegistration = (New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails' -tenantid $TenantFilter -asapp $true)
+    try {
+        $MFARegistration = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails?$top=999&$select=userPrincipalName,isMfaRegistered,isMfaCapable,methodsRegistered" -tenantid $TenantFilter -asapp $true)
+        $MFAIndex = @{}
+        foreach ($MFAEntry in $MFARegistration) {
+            $MFAIndex[$MFAEntry.userPrincipalName] = $MFAEntry
+        }
     } catch {
         $CAState.Add('Not Licensed for Conditional Access') | Out-Null
         $MFARegistration = $null
@@ -36,30 +39,166 @@ function Get-CIPPMFAState {
             $Errors.Add(@{Step = 'MFARegistration'; Message = $_.Exception.Message })
         }
         Write-Host "User registration details not available: $($_.Exception.Message)"
+        $MFAIndex = @{}
     }
 
     if ($null -ne $MFARegistration) {
         $CASuccess = $true
         try {
-            $CAPolicies = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies?$top=999' -tenantid $TenantFilter -ErrorAction Stop )
+            $CAPolicies = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies?$top=999&$filter=state eq ''enabled''&$select=id,displayName,state,grantControls,conditions' -tenantid $TenantFilter -ErrorAction Stop -AsApp $true)
+            $PolicyTable = @{}
+            $AllUserPolicies = [System.Collections.Generic.List[object]]::new()
+            $GroupsToResolve = [System.Collections.Generic.HashSet[string]]::new()
+            $ExcludeGroupsToResolve = [System.Collections.Generic.HashSet[string]]::new()
+
             foreach ($Policy in $CAPolicies) {
-                $IsMFAControl = $policy.grantControls.builtincontrols -eq 'mfa' -or $Policy.grantControls.authenticationStrength.requirementsSatisfied -eq 'mfa' -or $Policy.grantControls.customAuthenticationFactors -eq 'RequireDuoMfa'
-                $IsAllApps = [bool]($Policy.conditions.applications.includeApplications -eq 'All')
-                $IsAllUsers = [bool]($Policy.conditions.users.includeUsers -eq 'All')
-                $Platforms = $Policy.conditions.clientAppTypes
-
-                if ($IsMFAControl) {
-                    $CAState.Add([PSCustomObject]@{
-                            DisplayName   = $Policy.displayName
-                            State         = $Policy.state
-                            IncludedApps  = $Policy.conditions.applications.includeApplications
-                            IncludedUsers = $Policy.conditions.users.includeUsers
-                            ExcludedUsers = $Policy.conditions.users.excludeUsers
-                            IsAllApps     = $IsAllApps
-                            IsAllUsers    = $IsAllUsers
-                            Platforms     = $Platforms
+                # Only include policies that require MFA
+                $RequiresMFA = $false
+                if ($Policy.grantControls.builtInControls -contains 'mfa') {
+                    $RequiresMFA = $true
+                }
+                # Check for authentication strength requiring MFA
+                if ($Policy.grantControls.authenticationStrength.requirementsSatisfied -eq 'mfa') {
+                    $RequiresMFA = $true
+                }
+
+                if ($RequiresMFA) {
+                    # Handle user assignments
+                    if ($Policy.conditions.users.includeUsers -ne $null) {
+                        # Check if "All" is included
+                        if ($Policy.conditions.users.includeUsers -contains 'All') {
+                            $AllUserPolicies.Add($Policy)
+                        } else {
+                            foreach ($UserId in $Policy.conditions.users.includeUsers) {
+                                if (-not $PolicyTable.ContainsKey($UserId)) {
+                                    $PolicyTable[$UserId] = [System.Collections.Generic.List[object]]::new()
+                                }
+                                $PolicyTable[$UserId].Add($Policy)
+                            }
+                        }
+                    }
+
+                    # Collect groups to resolve
+                    if ($Policy.conditions.users.includeGroups -ne $null -and $Policy.conditions.users.includeGroups.Count -gt 0) {
+                        foreach ($GroupId in $Policy.conditions.users.includeGroups) {
+                            [void]$GroupsToResolve.Add($GroupId)
+                        }
+                    }
+
+                    # Collect exclude groups to resolve
+                    if ($Policy.conditions.users.excludeGroups -ne $null -and $Policy.conditions.users.excludeGroups.Count -gt 0) {
+                        foreach ($GroupId in $Policy.conditions.users.excludeGroups) {
+                            [void]$ExcludeGroupsToResolve.Add($GroupId)
+                        }
+                    }
+                }
+            }
+
+            # Resolve group memberships using bulk request
+            $UserGroupMembership = @{}
+            $UserExcludeGroupMembership = @{}
+            $GroupNameLookup = @{}
+
+            if ($GroupsToResolve.Count -gt 0 -or $ExcludeGroupsToResolve.Count -gt 0) {
+                $GroupMemberRequests = [system.collections.generic.list[object]]::new()
+                $GroupDetailsRequests = [system.collections.generic.list[object]]::new()
+                Write-Information "Resolving group memberships for $($GroupsToResolve.Count) include groups and $($ExcludeGroupsToResolve.Count) exclude groups"
+                # Add include group requests
+                foreach ($GroupId in $GroupsToResolve) {
+                    $GroupMemberRequests.Add(@{
+                            id     = "include-$GroupId"
+                            method = 'GET'
+                            url    = "groups/$($GroupId)/members?`$select=id"
+                        })
+                    $GroupDetailsRequests.Add(@{
+                            id     = "details-$GroupId"
+                            method = 'GET'
+                            url    = "groups/$($GroupId)?`$select=id,displayName"
+                        })
+                }
+
+                # Add exclude group requests
+                foreach ($GroupId in $ExcludeGroupsToResolve) {
+                    $GroupMemberRequests.Add(@{
+                            id     = "exclude-$GroupId"
+                            method = 'GET'
+                            url    = "groups/$($GroupId)/members?`$select=id"
+                        })
+                    $GroupDetailsRequests.Add(@{
+                            id     = "details-$GroupId"
+                            method = 'GET'
+                            url    = "groups/$($GroupId)?`$select=id,displayName"
                         })
                 }
+
+                $GroupMembersResults = New-GraphBulkRequest -Requests @($GroupMemberRequests) -tenantid $TenantFilter
+                $GroupDetailsResults = New-GraphBulkRequest -Requests @($GroupDetailsRequests) -tenantid $TenantFilter
+
+                # Build group name lookup
+                $GroupNameLookup = @{}
+                foreach ($GroupDetail in $GroupDetailsResults) {
+                    if ($GroupDetail.status -eq 200 -and $GroupDetail.body) {
+                        $GroupId = $GroupDetail.id -replace '^details-', ''
+                        $GroupNameLookup[$GroupId] = $GroupDetail.body.displayName
+                        Write-Host "Added group to lookup: $GroupId = $($GroupDetail.body.displayName)"
+                    } else {
+                        Write-Host "Failed to get group details: $($GroupDetail.id) - Status: $($GroupDetail.status)"
+                    }
+                }
+
+                # Build mapping of user to groups they're in
+                foreach ($GroupResult in $GroupMembersResults) {
+                    if ($GroupResult.status -eq 200 -and $GroupResult.body.value) {
+                        $IsExclude = $GroupResult.id -like 'exclude-*'
+                        $GroupId = $GroupResult.id -replace '^(include-|exclude-)', ''
+
+                        foreach ($Member in $GroupResult.body.value) {
+                            if ($IsExclude) {
+                                if (-not $UserExcludeGroupMembership.ContainsKey($Member.id)) {
+                                    $UserExcludeGroupMembership[$Member.id] = [System.Collections.Generic.HashSet[string]]::new()
+                                }
+                                [void]$UserExcludeGroupMembership[$Member.id].Add($GroupId)
+                            } else {
+                                if (-not $UserGroupMembership.ContainsKey($Member.id)) {
+                                    $UserGroupMembership[$Member.id] = [System.Collections.Generic.HashSet[string]]::new()
+                                }
+                                [void]$UserGroupMembership[$Member.id].Add($GroupId)
+                            }
+                        }
+                    }
+                }
+
+                # Now add policies to users based on group membership
+                foreach ($Policy in $CAPolicies | Where-Object { $_.conditions.users.includeGroups -ne $null -and $_.conditions.users.includeGroups.Count -gt 0 }) {
+                    # Check if this policy requires MFA
+                    $RequiresMFA = $false
+                    if ($Policy.grantControls.builtInControls -contains 'mfa') {
+                        $RequiresMFA = $true
+                    }
+                    if ($Policy.grantControls.authenticationStrength.requirementsSatisfied -eq 'mfa') {
+                        $RequiresMFA = $true
+                    }
+
+                    if ($RequiresMFA) {
+                        foreach ($UserId in $UserGroupMembership.Keys) {
+                            # Check if user is member of any of the policy's included groups
+                            $IsMember = $false
+                            foreach ($GroupId in $Policy.conditions.users.includeGroups) {
+                                if ($UserGroupMembership[$UserId].Contains($GroupId)) {
+                                    $IsMember = $true
+                                    break
+                                }
+                            }
+
+                            if ($IsMember) {
+                                if (-not $PolicyTable.ContainsKey($UserId)) {
+                                    $PolicyTable[$UserId] = [System.Collections.Generic.List[object]]::new()
+                                }
+                                $PolicyTable[$UserId].Add($Policy)
+                            }
+                        }
+                    }
+                }
             }
         } catch {
             $CASuccess = $false
@@ -69,33 +208,98 @@ function Get-CIPPMFAState {
     }
 
     if ($CAState.count -eq 0) { $CAState.Add('None') | Out-Null }
-    
-    $assignments = New-GraphGetRequest -uri  "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?`$expand=principal" -tenantid $TenantFilter -ErrorAction SilentlyContinue
+
+    $assignments = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments?`$expand=principal" -tenantid $TenantFilter -ErrorAction SilentlyContinue
 
     $adminObjectIds = $assignments |
-    Where-Object {
-        $_.principal.'@odata.type' -eq '#microsoft.graph.user'
-    } |
-    ForEach-Object {
-        $_.principal.id
-    }
+        Where-Object {
+            $_.principal.'@odata.type' -eq '#microsoft.graph.user'
+        } |
+        ForEach-Object {
+            $_.principal.id
+        }
 
     # Interact with query parameters or the body of the request.
     $GraphRequest = $Users | ForEach-Object {
         $UserCAState = [System.Collections.Generic.List[object]]::new()
-        foreach ($CA in $CAState) {
-            if ($CA.IncludedUsers -eq 'All' -or $CA.IncludedUsers -contains $_.ObjectId) {
-                $UserCAState.Add([PSCustomObject]@{
-                        DisplayName  = $CA.DisplayName
-                        UserIncluded = ($CA.ExcludedUsers -notcontains $_.ObjectId)
-                        AllApps      = $CA.IsAllApps
-                        PolicyState  = $CA.State
-                        Platforms    = $CA.Platforms -join ', '
-                    })
+
+        # Add policies that apply to this specific user
+        if ($PolicyTable.ContainsKey($_.ObjectId)) {
+            foreach ($Policy in $PolicyTable[$_.ObjectId]) {
+                # Check if user is excluded directly or via group
+                $IsExcluded = $Policy.conditions.users.excludeUsers -contains $_.ObjectId
+                $ExcludedViaGroup = $null
+
+                # Check exclude groups
+                if (-not $IsExcluded -and $Policy.conditions.users.excludeGroups -ne $null -and $Policy.conditions.users.excludeGroups.Count -gt 0) {
+                    if ($UserExcludeGroupMembership.ContainsKey($_.ObjectId)) {
+                        foreach ($ExcludeGroupId in $Policy.conditions.users.excludeGroups) {
+                            if ($UserExcludeGroupMembership[$_.ObjectId].Contains($ExcludeGroupId)) {
+                                $IsExcluded = $true
+                                $ExcludedViaGroup = if ($GroupNameLookup.ContainsKey($ExcludeGroupId)) {
+                                    $GroupNameLookup[$ExcludeGroupId]
+                                } else {
+                                    $ExcludeGroupId
+                                }
+                                break
+                            }
+                        }
+                    }
+                }
+
+                $PolicyObj = [PSCustomObject]@{
+                    DisplayName  = $Policy.displayName
+                    UserIncluded = -not $IsExcluded
+                    AllApps      = ($Policy.conditions.applications.includeApplications -contains 'All')
+                    PolicyState  = $Policy.state
+                }
+                if ($ExcludedViaGroup) {
+                    $PolicyObj | Add-Member -NotePropertyName 'ExcludedViaGroup' -NotePropertyValue $ExcludedViaGroup
+                }
+                $UserCAState.Add($PolicyObj)
+            }
+        }
+
+        # Add policies that apply to all users
+        foreach ($Policy in $AllUserPolicies) {
+            # Check if user is excluded directly or via group
+            $IsExcluded = $Policy.conditions.users.excludeUsers -contains $_.ObjectId
+            $ExcludedViaGroup = $null
+
+            # Check exclude groups
+            if (-not $IsExcluded -and $Policy.conditions.users.excludeGroups -ne $null -and $Policy.conditions.users.excludeGroups.Count -gt 0) {
+                if ($UserExcludeGroupMembership.ContainsKey($_.ObjectId)) {
+                    foreach ($ExcludeGroupId in $Policy.conditions.users.excludeGroups) {
+                        if ($UserExcludeGroupMembership[$_.ObjectId].Contains($ExcludeGroupId)) {
+                            $IsExcluded = $true
+                            $ExcludedViaGroup = if ($GroupNameLookup.ContainsKey($ExcludeGroupId)) {
+                                $GroupNameLookup[$ExcludeGroupId]
+                            } else {
+                                $ExcludeGroupId
+                            }
+                            break
+                        }
+                    }
+                }
             }
+
+            # Always add the policy to show it applies (even if excluded)
+            $PolicyObj = [PSCustomObject]@{
+                DisplayName  = $Policy.displayName
+                UserIncluded = -not $IsExcluded
+                AllApps      = ($Policy.conditions.applications.includeApplications -contains 'All')
+                PolicyState  = $Policy.state
+            }
+            if ($ExcludedViaGroup) {
+                $PolicyObj | Add-Member -NotePropertyName 'ExcludedViaGroup' -NotePropertyValue $ExcludedViaGroup
+            }
+            $UserCAState.Add($PolicyObj)
         }
-        if ($UserCAState.UserIncluded -eq $true -and $UserCAState.PolicyState -eq 'enabled') {
-            if ($UserCAState.UserIncluded -eq $true -and $UserCAState.PolicyState -eq 'enabled' -and $UserCAState.AllApps) {
+
+        # Determine if user is covered by CA
+        if ($UserCAState.Count -gt 0 -and ($UserCAState | Where-Object { $_.UserIncluded -eq $true -and $_.PolicyState -eq 'enabled' })) {
+            $EnabledPolicies = $UserCAState | Where-Object { $_.UserIncluded -eq $true -and $_.PolicyState -eq 'enabled' }
+            if ($EnabledPolicies | Where-Object { $_.AllApps -eq $true }) {
                 $CoveredByCA = 'Enforced - All Apps'
             } else {
                 $CoveredByCA = 'Enforced - Specific Apps'
@@ -111,7 +315,11 @@ function Get-CIPPMFAState {
 
         $PerUser = $_.PerUserMFAState
 
-        $MFARegUser = if ($null -eq ($MFARegistration | Where-Object -Property UserPrincipalName -EQ $_.userPrincipalName).isMFARegistered) { $false } else { ($MFARegistration | Where-Object -Property UserPrincipalName -EQ $_.userPrincipalName) }
+        $MFARegUser = if ($null -eq ($MFAIndex[$_.UserPrincipalName])) {
+            $false
+        } else {
+            $MFAIndex[$_.UserPrincipalName]
+        }
 
         [PSCustomObject]@{
             Tenant          = $TenantFilter
@@ -121,9 +329,9 @@ function Get-CIPPMFAState {
             AccountEnabled  = $_.accountEnabled
             PerUser         = $PerUser
             isLicensed      = $_.isLicensed
-            MFARegistration = $MFARegUser.isMFARegistered
-            MFACapable      = $MFARegUser.isMFACapable
-            MFAMethods      = $MFARegUser.methodsRegistered
+            MFARegistration = if ($MFARegUser) { $MFARegUser.isMfaRegistered } else { $false }
+            MFACapable      = if ($MFARegUser) { $MFARegUser.isMfaCapable } else { $false }
+            MFAMethods      = if ($MFARegUser) { $MFARegUser.methodsRegistered } else { @() }
             CoveredByCA     = $CoveredByCA
             CAPolicies      = $UserCAState
             CoveredBySD     = $SecureDefaultsState
diff --git a/Modules/CIPPCore/Public/Get-CIPPMFAStateReport.ps1 b/Modules/CIPPCore/Public/Get-CIPPMFAStateReport.ps1
new file mode 100644
index 000000000000..d0b32d9bbf55
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPMFAStateReport.ps1
@@ -0,0 +1,78 @@
+function Get-CIPPMFAStateReport {
+    <#
+    .SYNOPSIS
+        Generates an MFA state report from the CIPP Reporting database
+
+    .DESCRIPTION
+        Retrieves MFA state data for a tenant from the reporting database
+
+    .PARAMETER TenantFilter
+        The tenant to generate the report for
+
+    .EXAMPLE
+        Get-CIPPMFAStateReport -TenantFilter 'contoso.onmicrosoft.com'
+        Gets MFA state for all users in the tenant
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+
+        # Handle AllTenants
+        if ($TenantFilter -eq 'AllTenants') {
+            # Get all tenants that have MFA data
+            $AllMFAItems = Get-CIPPDbItem -TenantFilter 'allTenants' -Type 'MFAState'
+            $Tenants = @($AllMFAItems | Where-Object { $_.RowKey -ne 'MFAState-Count' } | Select-Object -ExpandProperty PartitionKey -Unique)
+
+            $AllResults = [System.Collections.Generic.List[PSCustomObject]]::new()
+            foreach ($Tenant in $Tenants) {
+                try {
+                    $TenantResults = Get-CIPPMFAStateReport -TenantFilter $Tenant
+                    foreach ($Result in $TenantResults) {
+                        # Add Tenant property to each result
+                        $Result | Add-Member -NotePropertyName 'Tenant' -NotePropertyValue $Tenant -Force
+                        $AllResults.Add($Result)
+                    }
+                } catch {
+                    Write-LogMessage -API 'MFAStateReport' -tenant $Tenant -message "Failed to get report for tenant: $($_.Exception.Message)" -sev Warning
+                }
+            }
+            return $AllResults
+        }
+
+        # Get MFA state from reporting DB
+        $MFAItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'MFAState'
+        if (-not $MFAItems) {
+            throw 'No MFA state data found in reporting database. Sync the report data first.'
+        }
+        # Get the most recent cache timestamp
+        $CacheTimestamp = ($MFAItems | Where-Object { $_.Timestamp } | Sort-Object Timestamp -Descending | Select-Object -First 1).Timestamp
+        # Parse MFA state data
+        $AllMFAState = [System.Collections.Generic.List[PSCustomObject]]::new()
+        foreach ($Item in $MFAItems | Where-Object { $_.RowKey -ne 'MFAState-Count' }) {
+            $MFAUser = $Item.Data | ConvertFrom-Json
+
+            # Parse nested JSON properties if they're strings
+            if ($MFAUser.CAPolicies -is [string]) {
+                $MFAUser.CAPolicies = try { $MFAUser.CAPolicies | ConvertFrom-Json } catch { $MFAUser.CAPolicies }
+            }
+            if ($MFAUser.MFAMethods -is [string]) {
+                $MFAUser.MFAMethods = try { $MFAUser.MFAMethods | ConvertFrom-Json } catch { $MFAUser.MFAMethods }
+            }
+
+            # Add cache timestamp
+            $MFAUser | Add-Member -NotePropertyName 'CacheTimestamp' -NotePropertyValue $CacheTimestamp -Force
+
+            $AllMFAState.Add($MFAUser)
+        }
+
+        return $AllMFAState
+
+    } catch {
+        Write-LogMessage -API 'MFAStateReport' -tenant $TenantFilter -message "Failed to generate MFA state report: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPMailboxPermissionReport.ps1 b/Modules/CIPPCore/Public/Get-CIPPMailboxPermissionReport.ps1
new file mode 100644
index 000000000000..29bb8efb1ac7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPMailboxPermissionReport.ps1
@@ -0,0 +1,226 @@
+function Get-CIPPMailboxPermissionReport {
+    <#
+    .SYNOPSIS
+        Generates a mailbox permission report from the CIPP Reporting database
+
+    .DESCRIPTION
+        Retrieves mailbox permissions for a tenant and formats them into a report.
+        Default view shows permissions per mailbox. Use -ByUser to pivot by user.
+
+    .PARAMETER TenantFilter
+        The tenant to generate the report for
+
+    .PARAMETER ByUser
+        If specified, groups results by user instead of by mailbox
+
+    .EXAMPLE
+        Get-CIPPMailboxPermissionReport -TenantFilter 'contoso.onmicrosoft.com'
+        Shows which users have access to each mailbox
+
+    .EXAMPLE
+        Get-CIPPMailboxPermissionReport -TenantFilter 'contoso.onmicrosoft.com' -ByUser
+        Shows what mailboxes each user has access to
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [switch]$ByUser
+    )
+
+    try {
+        Write-LogMessage -API 'MailboxPermissionReport' -tenant $TenantFilter -message 'Generating mailbox permission report' -sev Info
+
+        # Handle AllTenants
+        if ($TenantFilter -eq 'AllTenants') {
+            # Get all tenants that have mailbox data
+            $AllMailboxItems = Get-CIPPDbItem -TenantFilter 'allTenants' -Type 'Mailboxes'
+            $Tenants = @($AllMailboxItems | Where-Object { $_.RowKey -ne 'Mailboxes-Count' } | Select-Object -ExpandProperty PartitionKey -Unique)
+
+            $AllResults = [System.Collections.Generic.List[PSCustomObject]]::new()
+            foreach ($Tenant in $Tenants) {
+                try {
+                    $TenantResults = Get-CIPPMailboxPermissionReport -TenantFilter $Tenant -ByUser:$ByUser
+                    foreach ($Result in $TenantResults) {
+                        # Add Tenant property to each result
+                        $Result | Add-Member -NotePropertyName 'Tenant' -NotePropertyValue $Tenant -Force
+                        $AllResults.Add($Result)
+                    }
+                } catch {
+                    Write-LogMessage -API 'MailboxPermissionReport' -tenant $Tenant -message "Failed to get report for tenant: $($_.Exception.Message)" -sev Warning
+                }
+            }
+            return $AllResults
+        }
+
+        # Get mailboxes from reporting DB
+        $MailboxItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Mailboxes'
+        if (-not $MailboxItems) {
+            throw 'No mailbox data found in reporting database. Sync the mailbox permissions first. '
+        }
+
+        # Get the most recent mailbox cache timestamp
+        $MailboxCacheTimestamp = ($MailboxItems | Where-Object { $_.Timestamp } | Sort-Object Timestamp -Descending | Select-Object -First 1).Timestamp
+
+        # Parse mailbox data and create lookup by UPN, ID, and ExternalDirectoryObjectId (case-insensitive)
+        $MailboxLookup = @{}
+        $MailboxByIdLookup = @{}
+        $MailboxByExternalIdLookup = @{}
+        foreach ($Item in $MailboxItems | Where-Object { $_.RowKey -ne 'Mailboxes-Count' }) {
+            $Mailbox = $Item.Data | ConvertFrom-Json
+            if ($Mailbox.UPN) {
+                $MailboxLookup[$Mailbox.UPN.ToLower()] = $Mailbox
+            }
+            if ($Mailbox.primarySmtpAddress) {
+                $MailboxLookup[$Mailbox.primarySmtpAddress.ToLower()] = $Mailbox
+            }
+            if ($Mailbox.Id) {
+                $MailboxByIdLookup[$Mailbox.Id] = $Mailbox
+            }
+            if ($Mailbox.ExternalDirectoryObjectId) {
+                $MailboxByExternalIdLookup[$Mailbox.ExternalDirectoryObjectId] = $Mailbox
+            }
+        }
+
+        # Get mailbox permissions from reporting DB
+        $PermissionItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailboxPermissions'
+        if (-not $PermissionItems) {
+            throw 'No mailbox permission data found in reporting database. Run a scan first.'
+        }
+
+        # Get the most recent permission cache timestamp
+        $PermissionCacheTimestamp = ($PermissionItems | Where-Object { $_.Timestamp } | Sort-Object Timestamp -Descending | Select-Object -First 1).Timestamp
+
+        # Parse all permissions
+        $AllPermissions = [System.Collections.Generic.List[PSCustomObject]]::new()
+        foreach ($Item in $PermissionItems | Where-Object { $_.RowKey -ne 'MailboxPermissions-Count' }) {
+            $Permissions = $Item.Data | ConvertFrom-Json
+            foreach ($Permission in $Permissions) {
+                # Skip SELF permissions and inherited deny permissions
+                if ($Permission.User -eq 'NT AUTHORITY\SELF' -or $Permission.Deny -eq $true) {
+                    continue
+                }
+
+                # Get mailbox info - try multiple match strategies like CustomDataSync does
+                $Mailbox = $null
+                if ($Permission.Identity) {
+                    # Try UPN/primarySmtpAddress lookup (case-insensitive)
+                    $Mailbox = $MailboxLookup[$Permission.Identity.ToLower()]
+
+                    # If not found, try ExternalDirectoryObjectId lookup
+                    if (-not $Mailbox) {
+                        $Mailbox = $MailboxByExternalIdLookup[$Permission.Identity]
+                    }
+
+                    # If not found, try ID lookup
+                    if (-not $Mailbox) {
+                        $Mailbox = $MailboxByIdLookup[$Permission.Identity]
+                    }
+                }
+
+                if (-not $Mailbox) {
+                    Write-Verbose "No mailbox found for Identity: $($Permission.Identity)"
+                    continue
+                }
+
+                $AllPermissions.Add([PSCustomObject]@{
+                        MailboxUPN         = if ($Mailbox.UPN) { $Mailbox.UPN } elseif ($Mailbox.primarySmtpAddress) { $Mailbox.primarySmtpAddress } else { $Permission.Identity }
+                        MailboxDisplayName = $Mailbox.displayName
+                        MailboxType        = $Mailbox.recipientTypeDetails
+                        User               = $Permission.User
+                        UserKey            = if ($Permission.User -match '@') { $Permission.User.ToLower() } else { $Permission.User }
+                        AccessRights       = ($Permission.AccessRights -join ', ')
+                        IsInherited        = $Permission.IsInherited
+                        Deny               = $Permission.Deny
+                    })
+            }
+        }
+
+        if ($AllPermissions.Count -eq 0) {
+            Write-LogMessage -API 'MailboxPermissionReport' -tenant $TenantFilter -message 'No mailbox permissions found (excluding SELF)' -sev Debug
+            Write-Information -Message 'No mailbox permissions found (excluding SELF)'
+            return @()
+        }
+
+        # Format results based on grouping preference
+        if ($ByUser) {
+            # Group by user - calculate which mailboxes each user has access to
+            # Use UserKey for grouping to handle case-insensitive email addresses
+            $Report = $AllPermissions | Group-Object -Property UserKey | ForEach-Object {
+                $UserKey = $_.Name
+                $UserDisplay = $_.Group[0].User # Use original User value for display
+
+                # Look up the user's mailbox type using multi-strategy approach
+                $UserMailbox = $null
+                if ($UserDisplay) {
+                    # Try UPN/primarySmtpAddress lookup (case-insensitive)
+                    $UserMailbox = $MailboxLookup[$UserDisplay.ToLower()]
+
+                    # If not found, try ExternalDirectoryObjectId lookup
+                    if (-not $UserMailbox) {
+                        $UserMailbox = $MailboxByExternalIdLookup[$UserDisplay]
+                    }
+
+                    # If not found, try ID lookup
+                    if (-not $UserMailbox) {
+                        $UserMailbox = $MailboxByIdLookup[$UserDisplay]
+                    }
+                }
+                $UserMailboxType = if ($UserMailbox) { $UserMailbox.recipientTypeDetails } else { 'Unknown' }
+
+                # Build detailed permissions list with mailbox and access rights
+                $PermissionDetails = @($_.Group | ForEach-Object {
+                        [PSCustomObject]@{
+                            Mailbox      = $_.MailboxDisplayName
+                            MailboxUPN   = $_.MailboxUPN
+                            AccessRights = $_.AccessRights
+                        }
+                    })
+
+                [PSCustomObject]@{
+                    User                     = $UserDisplay
+                    UserMailboxType          = $UserMailboxType
+                    MailboxCount             = $_.Count
+                    Permissions              = $PermissionDetails
+                    Tenant                   = $TenantFilter
+                    MailboxCacheTimestamp    = $MailboxCacheTimestamp
+                    PermissionCacheTimestamp = $PermissionCacheTimestamp
+                }
+            } | Sort-Object User
+        } else {
+            # Default: Group by mailbox
+            $Report = $AllPermissions | Group-Object -Property MailboxUPN | ForEach-Object {
+                $MailboxUPN = $_.Name
+                $MailboxInfo = $_.Group[0]
+
+                # Build detailed permissions list with user and access rights
+                $PermissionDetails = @($_.Group | ForEach-Object {
+                        [PSCustomObject]@{
+                            User         = $_.User
+                            AccessRights = $_.AccessRights
+                        }
+                    })
+
+                [PSCustomObject]@{
+                    MailboxUPN               = $MailboxUPN
+                    MailboxDisplayName       = $MailboxInfo.MailboxDisplayName
+                    MailboxType              = $MailboxInfo.MailboxType
+                    PermissionCount          = $_.Count
+                    Permissions              = $PermissionDetails
+                    Tenant                   = $TenantFilter
+                    MailboxCacheTimestamp    = $MailboxCacheTimestamp
+                    PermissionCacheTimestamp = $PermissionCacheTimestamp
+                }
+            } | Sort-Object MailboxDisplayName
+        }
+
+        Write-LogMessage -API 'MailboxPermissionReport' -tenant $TenantFilter -message "Generated report with $($Report.Count) entries" -sev Debug
+        return $Report
+
+    } catch {
+        Write-LogMessage -API 'MailboxPermissionReport' -tenant $TenantFilter -message "Failed to generate mailbox permission report: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_)
+        throw "Failed to generate mailbox permission report: $($_.Exception.Message)"
+    }
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPTestResults.ps1 b/Modules/CIPPCore/Public/Get-CIPPTestResults.ps1
new file mode 100644
index 000000000000..312236c81c4d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPTestResults.ps1
@@ -0,0 +1,44 @@
+function Get-CIPPTestResults {
+    <#
+    .SYNOPSIS
+        Retrieves test results and tenant counts for a specific tenant
+
+    .PARAMETER TenantFilter
+        The tenant domain or GUID to retrieve results for
+
+    .EXAMPLE
+        Get-CIPPTestResults -TenantFilter 'contoso.onmicrosoft.com'
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        $Table = Get-CippTable -tablename 'CippTestResults'
+        $Filter = "PartitionKey eq '{0}'" -f $TenantFilter
+        $TestResults = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+
+        $CountData = Get-CIPPDbItem -TenantFilter $TenantFilter -CountsOnly
+
+        $TenantCounts = @{}
+        $LatestTimestamp = $null
+
+        foreach ($CountRow in $CountData) {
+            $TypeName = $CountRow.RowKey -replace '-Count$', ''
+            $TenantCounts[$TypeName] = $CountRow.DataCount
+            $LatestTimestamp = $CountRow.Timestamp
+        }
+
+        return [PSCustomObject]@{
+            TestResults           = $TestResults
+            TenantCounts          = $TenantCounts
+            LatestReportTimeStamp = $LatestTimestamp
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPTestResults' -tenant $TenantFilter -message "Failed to get test results: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/Get-CippDbRole.ps1 b/Modules/CIPPCore/Public/Get-CippDbRole.ps1
new file mode 100644
index 000000000000..02313a9a96ad
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CippDbRole.ps1
@@ -0,0 +1,53 @@
+function Get-CippDbRole {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [switch]$IncludePrivilegedRoles,
+
+        [Parameter(Mandatory = $false)]
+        [switch]$CisaHighlyPrivilegedRoles
+    )
+
+    $Roles = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Roles'
+
+    if ($IncludePrivilegedRoles) {
+        $PrivilegedRoleTemplateIds = @(
+            '62e90394-69f5-4237-9190-012177145e10',
+            '194ae4cb-b126-40b2-bd5b-6091b380977d',
+            '9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3',
+            'e8611ab8-c189-46e8-94e1-60213ab1f814',
+            '29232cdf-9323-42fd-ade2-1d097af3e4de',
+            'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9',
+            'f28a1f50-f6e7-4571-818b-6a12f2af6b6c',
+            'fe930be7-5e62-47db-91af-98c3a49a38b1',
+            '729827e3-9c14-49f7-bb1b-9608f156bbb8',
+            '966707d0-3269-4727-9be2-8c3a10f19b9d',
+            'b0f54661-2d74-4c50-afa3-1ec803f12efe',
+            '7be44c8a-adaf-4e2a-84d6-ab2649e08a13',
+            '158c047a-c907-4556-b7ef-446551a6b5f7',
+            'c4e39bd9-1100-46d3-8c65-fb160da0071f',
+            '9f06204d-73c1-4d4c-880a-6edb90606fd8',
+            '17315797-102d-40b4-93e0-432062caca18',
+            '4a5d8f65-41da-4de4-8968-e035b65339cf',
+            '75941009-915a-4869-abe7-691bff18279e'
+        )
+        $Roles = $Roles | Where-Object { $PrivilegedRoleTemplateIds -contains $_.RoletemplateId }
+    }
+
+    if ($CisaHighlyPrivilegedRoles) {
+        $CisaRoleTemplateIds = @(
+            '62e90394-69f5-4237-9190-012177145e10',
+            '9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3',
+            '29232cdf-9323-42fd-ade2-1d097af3e4de',
+            '729827e3-9c14-49f7-bb1b-9608f156bbb8',
+            '966707d0-3269-4727-9be2-8c3a10f19b9d',
+            'b0f54661-2d74-4c50-afa3-1ec803f12efe'
+        )
+        $Roles = $Roles | Where-Object { $CisaRoleTemplateIds -contains $_.RoletemplateId }
+    }
+
+    return $Roles
+}
diff --git a/Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1 b/Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1
new file mode 100644
index 000000000000..907917fa69d7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1
@@ -0,0 +1,49 @@
+function Get-CippDbRoleMembers {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $true)]
+        [string]$RoleTemplateId
+    )
+
+    $RoleAssignments = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'RoleAssignmentScheduleInstances'
+    $RoleEligibilities = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'RoleEligibilitySchedules'
+
+    $ActiveMembers = $RoleAssignments | Where-Object {
+        $_.roleDefinitionId -eq $RoleTemplateId -and $_.assignmentType -eq 'Assigned'
+    }
+
+    $EligibleMembers = $RoleEligibilities | Where-Object {
+        $_.roleDefinitionId -eq $RoleTemplateId
+    }
+
+    $AllMembers = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($member in $ActiveMembers) {
+        $memberObj = [PSCustomObject]@{
+            id                = $member.principalId
+            displayName       = $member.principal.displayName
+            userPrincipalName = $member.principal.userPrincipalName
+            '@odata.type'     = $member.principal.'@odata.type'
+            AssignmentType    = 'Active'
+        }
+        $AllMembers.Add($memberObj)
+    }
+
+    foreach ($member in $EligibleMembers) {
+        if ($AllMembers.id -notcontains $member.principalId) {
+            $memberObj = [PSCustomObject]@{
+                id                = $member.principalId
+                displayName       = $member.principal.displayName
+                userPrincipalName = $member.principal.userPrincipalName
+                '@odata.type'     = $member.principal.'@odata.type'
+                AssignmentType    = 'Eligible'
+            }
+            $AllMembers.Add($memberObj)
+        }
+    }
+
+    return $AllMembers
+}
diff --git a/Modules/CIPPCore/Public/GraphHelper/New-CIPPAzServiceSAS.ps1 b/Modules/CIPPCore/Public/GraphHelper/New-CIPPAzServiceSAS.ps1
new file mode 100644
index 000000000000..9f7f35d1eacb
--- /dev/null
+++ b/Modules/CIPPCore/Public/GraphHelper/New-CIPPAzServiceSAS.ps1
@@ -0,0 +1,291 @@
+function New-CIPPAzServiceSAS {
+    [CmdletBinding()] param(
+        [Parameter(Mandatory = $true)] [string] $AccountName,
+        [Parameter(Mandatory = $true)] [string] $AccountKey,
+        [Parameter(Mandatory = $true)] [ValidateSet('blob', 'queue', 'file', 'table')] [string] $Service,
+        [Parameter(Mandatory = $true)] [string] $ResourcePath,
+        [Parameter(Mandatory = $true)] [string] $Permissions,
+        [Parameter(Mandatory = $false)] [DateTime] $StartTime,
+        [Parameter(Mandatory = $true)] [DateTime] $ExpiryTime,
+        [Parameter(Mandatory = $false)] [ValidateSet('http', 'https', 'https,http')] [string] $Protocol = 'https',
+        [Parameter(Mandatory = $false)] [string] $IP,
+        [Parameter(Mandatory = $false)] [string] $SignedIdentifier,
+        [Parameter(Mandatory = $false)] [string] $Version = '2022-11-02',
+        [Parameter(Mandatory = $false)] [ValidateSet('b', 'c', 'd', 'bv', 'bs', 'f', 's')] [string] $SignedResource,
+        [Parameter(Mandatory = $false)] [int] $DirectoryDepth,
+        [Parameter(Mandatory = $false)] [string] $SnapshotTime,
+        # Optional response header overrides (Blob/Files)
+        [Parameter(Mandatory = $false)] [string] $CacheControl,
+        [Parameter(Mandatory = $false)] [string] $ContentDisposition,
+        [Parameter(Mandatory = $false)] [string] $ContentEncoding,
+        [Parameter(Mandatory = $false)] [string] $ContentLanguage,
+        [Parameter(Mandatory = $false)] [string] $ContentType,
+        # Optional encryption scope (Blob, 2020-12-06+)
+        [Parameter(Mandatory = $false)] [string] $EncryptionScope,
+        # Optional connection string for endpoint/emulator support
+        [Parameter(Mandatory = $false)] [string] $ConnectionString = $env:AzureWebJobsStorage
+    )
+
+    # Local helpers: canonicalized resource and signature (standalone)
+    function _GetCanonicalizedResource {
+        param(
+            [Parameter(Mandatory = $true)][string] $AccountName,
+            [Parameter(Mandatory = $true)][ValidateSet('blob', 'queue', 'file', 'table')] [string] $Service,
+            [Parameter(Mandatory = $true)][string] $ResourcePath
+        )
+        $decodedPath = [System.Web.HttpUtility]::UrlDecode(($ResourcePath.TrimStart('/')))
+        switch ($Service) {
+            'blob' { return "/blob/$AccountName/$decodedPath" }
+            'queue' { return "/queue/$AccountName/$decodedPath" }
+            'file' { return "/file/$AccountName/$decodedPath" }
+            'table' { return "/table/$AccountName/$decodedPath" }
+        }
+    }
+
+    function _NewSharedKeySignature {
+        param(
+            [Parameter(Mandatory = $true)][string] $AccountKey,
+            [Parameter(Mandatory = $true)][string] $StringToSign
+        )
+        $keyBytes = [Convert]::FromBase64String($AccountKey)
+        $hmac = [System.Security.Cryptography.HMACSHA256]::new($keyBytes)
+        try {
+            $bytes = [System.Text.Encoding]::UTF8.GetBytes($StringToSign)
+            $sig = $hmac.ComputeHash($bytes)
+            return [Convert]::ToBase64String($sig)
+        } finally { $hmac.Dispose() }
+    }
+
+    # Parse connection string for emulator/provided endpoints
+    $ProvidedEndpoint = $null
+    $ProvidedPath = $null
+    $EmulatorHost = $null
+    $EndpointSuffix = 'core.windows.net'
+
+    if ($ConnectionString) {
+        $conn = @{}
+        foreach ($part in ($ConnectionString -split ';')) {
+            $p = $part.Trim()
+            if ($p -and $p -match '^(.+?)=(.+)$') { $conn[$matches[1]] = $matches[2] }
+        }
+        if ($conn['EndpointSuffix']) { $EndpointSuffix = $conn['EndpointSuffix'] }
+
+        $ServiceCapitalized = [char]::ToUpper($Service[0]) + $Service.Substring(1)
+        $EndpointKey = "${ServiceCapitalized}Endpoint"
+        if ($conn[$EndpointKey]) {
+            $ProvidedEndpoint = $conn[$EndpointKey]
+            $ep = [Uri]::new($ProvidedEndpoint)
+            $Protocol = $ep.Scheme
+            $EmulatorHost = $ep.Host
+            if ($ep.Port -ne -1) { $EmulatorHost = "$($ep.Host):$($ep.Port)" }
+            $ProvidedPath = $ep.AbsolutePath.TrimEnd('/')
+        } elseif ($conn['UseDevelopmentStorage'] -eq 'true') {
+            # Emulator defaults
+            if (-not $AccountName) { $AccountName = 'devstoreaccount1' }
+            if (-not $AccountKey) { $AccountKey = 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==' }
+            $Protocol = 'http'
+            $ports = @{ blob = 10000; queue = 10001; table = 10002 }
+            $EmulatorHost = "127.0.0.1:$($ports[$Service])"
+        }
+    }
+
+    # Build the resource URI
+    if ($ResourcePath.StartsWith('/')) { $ResourcePath = $ResourcePath.TrimStart('/') }
+    $UriBuilder = [System.UriBuilder]::new()
+    $UriBuilder.Scheme = $Protocol
+
+    if ($ProvidedEndpoint) {
+        # Use provided endpoint + its base path
+        if ($EmulatorHost -match '^(.+?):(\d+)$') { $UriBuilder.Host = $matches[1]; $UriBuilder.Port = [int]$matches[2] }
+        else { $UriBuilder.Host = $EmulatorHost }
+        $UriBuilder.Path = ("$ProvidedPath/$ResourcePath").Replace('//', '/')
+    } elseif ($EmulatorHost) {
+        # Emulator: include account name in path
+        if ($EmulatorHost -match '^(.+?):(\d+)$') { $UriBuilder.Host = $matches[1]; $UriBuilder.Port = [int]$matches[2] }
+        else { $UriBuilder.Host = $EmulatorHost }
+        $UriBuilder.Path = "$AccountName/$ResourcePath"
+    } else {
+        # Standard Azure endpoint
+        $UriBuilder.Host = "$AccountName.$Service.$EndpointSuffix"
+        $UriBuilder.Path = $ResourcePath
+    }
+    $uri = $UriBuilder.Uri
+
+    # Canonicalized resource for SAS string-to-sign (service-name style, 2015-02-21+)
+    $canonicalizedResource = _GetCanonicalizedResource -AccountName $AccountName -Service $Service -ResourcePath $ResourcePath
+
+    # Time formatting per SAS spec (ISO 8601 UTC)
+    function _FormatSasTime($dt) {
+        if ($null -eq $dt) { return '' }
+        if ($dt -is [string]) {
+            if ([string]::IsNullOrWhiteSpace($dt)) { return '' }
+            $parsed = [DateTime]::Parse($dt, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AssumeUniversal)
+            $utc = $parsed.ToUniversalTime()
+            return $utc.ToString('yyyy-MM-ddTHH:mm:ssZ')
+        }
+        if ($dt -is [DateTime]) {
+            $utc = ([DateTime]$dt).ToUniversalTime()
+            return $utc.ToString('yyyy-MM-ddTHH:mm:ssZ')
+        }
+        return ''
+    }
+
+    $st = _FormatSasTime $StartTime
+    $se = _FormatSasTime $ExpiryTime
+    if ([string]::IsNullOrEmpty($se)) { throw 'ExpiryTime is required for SAS generation.' }
+
+    # Assemble query parameters (service-specific)
+    $q = @{}
+    $q['sp'] = $Permissions
+    if ($st) { $q['st'] = $st }
+    $q['se'] = $se
+    if ($IP) { $q['sip'] = $IP }
+    if ($Protocol) { $q['spr'] = $Protocol }
+    if ($Version) { $q['sv'] = $Version }
+    if ($SignedIdentifier) { $q['si'] = $SignedIdentifier }
+
+    # Blob/Files response headers overrides
+    if ($CacheControl) { $q['rscc'] = $CacheControl }
+    if ($ContentDisposition) { $q['rscd'] = $ContentDisposition }
+    if ($ContentEncoding) { $q['rsce'] = $ContentEncoding }
+    if ($ContentLanguage) { $q['rscl'] = $ContentLanguage }
+    if ($ContentType) { $q['rsct'] = $ContentType }
+
+    # Resource-type specifics
+    $includeEncryptionScope = $false
+    if ($Service -eq 'blob') {
+        if (-not $SignedResource) { throw 'SignedResource (sr) is required for blob SAS: use b, c, d, bv, or bs.' }
+        $q['sr'] = $SignedResource
+        # Blob snapshot time uses the 'snapshot' parameter when applicable
+        if ($SnapshotTime) { $q['snapshot'] = $SnapshotTime }
+        if ($SignedResource -eq 'd') {
+            if ($null -eq $DirectoryDepth) { throw 'DirectoryDepth (sdd) is required when sr=d (Data Lake Hierarchical Namespace).' }
+            $q['sdd'] = [string]$DirectoryDepth
+        }
+        if ($EncryptionScope -and $Version -ge '2020-12-06') {
+            $q['ses'] = $EncryptionScope
+            $includeEncryptionScope = $true
+        }
+    } elseif ($Service -eq 'file') {
+        if (-not $SignedResource) { throw 'SignedResource (sr) is required for file SAS: use f or s.' }
+        $q['sr'] = $SignedResource
+        if ($SnapshotTime) { $q['sst'] = $SnapshotTime }
+    } elseif ($Service -eq 'table') {
+        # Table SAS may include ranges (spk/srk/epk/erk), omitted here unless future parameters are added
+        # Table also uses tn (table name) in query, but canonicalizedResource already includes table name
+        # We rely on canonicalizedResource and omit tn unless specified by callers via ResourcePath
+    } elseif ($Service -eq 'queue') {
+        # No sr for queue
+    }
+
+    # Construct string-to-sign based on service and version
+    $StringToSign = $null
+    if ($Service -eq 'blob') {
+        # Version 2018-11-09 and later (optionally 2020-12-06 with encryption scope)
+        $fields = @(
+            $q['sp'],
+            ($st ?? ''),
+            $q['se'],
+            $canonicalizedResource,
+            ($q.ContainsKey('si') ? $q['si'] : ''),
+            ($q.ContainsKey('sip') ? $q['sip'] : ''),
+            ($q.ContainsKey('spr') ? $q['spr'] : ''),
+            ($q.ContainsKey('sv') ? $q['sv'] : ''),
+            $q['sr'],
+            ($q.ContainsKey('snapshot') ? $q['snapshot'] : ''),
+            ($includeEncryptionScope ? $q['ses'] : ''),
+            ($q.ContainsKey('rscc') ? $q['rscc'] : ''),
+            ($q.ContainsKey('rscd') ? $q['rscd'] : ''),
+            ($q.ContainsKey('rsce') ? $q['rsce'] : ''),
+            ($q.ContainsKey('rscl') ? $q['rscl'] : ''),
+            ($q.ContainsKey('rsct') ? $q['rsct'] : '')
+        )
+        $StringToSign = ($fields -join "`n")
+    } elseif ($Service -eq 'file') {
+        # Use 2015-04-05+ format (no signedResource in string until 2018-11-09; we include response headers)
+        $fields = @(
+            $q['sp'],
+            ($st ?? ''),
+            $q['se'],
+            $canonicalizedResource,
+            ($q.ContainsKey('si') ? $q['si'] : ''),
+            ($q.ContainsKey('sip') ? $q['sip'] : ''),
+            ($q.ContainsKey('spr') ? $q['spr'] : ''),
+            ($q.ContainsKey('sv') ? $q['sv'] : ''),
+            ($q.ContainsKey('rscc') ? $q['rscc'] : ''),
+            ($q.ContainsKey('rscd') ? $q['rscd'] : ''),
+            ($q.ContainsKey('rsce') ? $q['rsce'] : ''),
+            ($q.ContainsKey('rscl') ? $q['rscl'] : ''),
+            ($q.ContainsKey('rsct') ? $q['rsct'] : '')
+        )
+        $StringToSign = ($fields -join "`n")
+    } elseif ($Service -eq 'queue') {
+        # Version 2015-04-05 and later
+        $fields = @(
+            $q['sp'],
+            ($st ?? ''),
+            $q['se'],
+            $canonicalizedResource,
+            ($q.ContainsKey('si') ? $q['si'] : ''),
+            ($q.ContainsKey('sip') ? $q['sip'] : ''),
+            ($q.ContainsKey('spr') ? $q['spr'] : ''),
+            ($q.ContainsKey('sv') ? $q['sv'] : '')
+        )
+        $StringToSign = ($fields -join "`n")
+    } elseif ($Service -eq 'table') {
+        # Version 2015-04-05 and later
+        $fields = @(
+            $q['sp'],
+            ($st ?? ''),
+            $q['se'],
+            $canonicalizedResource,
+            ($q.ContainsKey('si') ? $q['si'] : ''),
+            ($q.ContainsKey('sip') ? $q['sip'] : ''),
+            ($q.ContainsKey('spr') ? $q['spr'] : ''),
+            ($q.ContainsKey('sv') ? $q['sv'] : ''),
+            '', # startingPartitionKey
+            '', # startingRowKey
+            '', # endingPartitionKey
+            ''  # endingRowKey
+        )
+        $StringToSign = ($fields -join "`n")
+    }
+
+    # Generate signature using account key (HMAC-SHA256 over UTF-8 string-to-sign)
+    try {
+        $SignatureBase64 = _NewSharedKeySignature -AccountKey $AccountKey -StringToSign $StringToSign
+    } catch {
+        throw "Failed to create SAS signature: $($_.Exception.Message)"
+    }
+
+    # Store signature; will be URL-encoded when assembling query
+    $q['sig'] = $SignatureBase64
+
+    # Compose ordered query for readability (common fields first)
+    $orderedKeys = @('sp', 'st', 'se', 'sip', 'spr', 'sv', 'sr', 'si', 'snapshot', 'ses', 'sdd', 'rscc', 'rscd', 'rsce', 'rscl', 'rsct', 'sig')
+    $parts = [System.Collections.Generic.List[string]]::new()
+    foreach ($k in $orderedKeys) {
+        if ($q.ContainsKey($k) -and -not [string]::IsNullOrEmpty($q[$k])) {
+            $parts.Add("$k=" + [System.Net.WebUtility]::UrlEncode($q[$k]))
+        }
+    }
+    # Include any remaining keys
+    foreach ($k in $q.Keys) {
+        if ($orderedKeys -notcontains $k) {
+            $parts.Add("$k=" + [System.Net.WebUtility]::UrlEncode($q[$k]))
+        }
+    }
+
+    $token = '?' + ($parts -join '&')
+
+    # Return structured output for debugging/usage
+    [PSCustomObject]@{
+        Token                 = $token
+        Query                 = $q
+        CanonicalizedResource = $canonicalizedResource
+        StringToSign          = $StringToSign
+        Version               = $Version
+        Service               = $Service
+        ResourceUri           = $uri.AbsoluteUri
+    }
+}
diff --git a/Modules/CIPPCore/Public/GraphHelper/New-CIPPAzStorageRequest.ps1 b/Modules/CIPPCore/Public/GraphHelper/New-CIPPAzStorageRequest.ps1
index f97fe0ad77b5..96f2cd729593 100644
--- a/Modules/CIPPCore/Public/GraphHelper/New-CIPPAzStorageRequest.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/New-CIPPAzStorageRequest.ps1
@@ -475,7 +475,13 @@ function New-CIPPAzStorageRequest {
 
         # Do not force JSON Accept on blob/queue; service returns XML for list ops
         if (-not $RequestHeaders.ContainsKey('Accept')) {
-            $RequestHeaders['Accept'] = 'application/xml'
+            if ($Service -eq 'blob') {
+                $isList = (($Component -eq 'list') -or ($Uri.Query -match 'comp=list'))
+                if ($isList) { $RequestHeaders['Accept'] = 'application/xml' }
+            } elseif ($Service -eq 'queue') {
+                $RequestHeaders['Accept'] = 'application/xml'
+            }
+            # For Azure Files, avoid forcing Accept; binary downloads should be raw bytes
         }
 
         # Merge user-provided headers (these override defaults)
@@ -500,6 +506,41 @@ function New-CIPPAzStorageRequest {
             $RequestHeaders['Content-Length'] = $ContentLength.ToString()
         }
 
+        # Blob upload: default to BlockBlob when performing a simple Put Blob (no comp parameter)
+        if ($Service -eq 'blob') {
+            $isCompSpecified = ($Component) -or ($Uri.Query -match 'comp=')
+            if ($Method -eq 'PUT' -and -not $isCompSpecified) {
+                if (-not $RequestHeaders.ContainsKey('x-ms-blob-type')) { $RequestHeaders['x-ms-blob-type'] = 'BlockBlob' }
+            }
+        }
+
+        # Azure Files specific conveniences and validations
+        if ($Service -eq 'file') {
+            # Create file: PUT to file path without comp=range should specify x-ms-type and x-ms-content-length; body typically empty
+            $isRangeOp = ($Component -eq 'range') -or ($Uri.Query -match 'comp=range')
+            if ($Method -eq 'PUT' -and -not $isRangeOp) {
+                if (-not $RequestHeaders.ContainsKey('x-ms-type')) { $RequestHeaders['x-ms-type'] = 'file' }
+                # x-ms-content-length is required for create; if not provided by caller, try to infer from header Content-Length when body is empty
+                if (-not $RequestHeaders.ContainsKey('x-ms-content-length')) {
+                    if ($ContentLength -eq 0) {
+                        # Caller must supply x-ms-content-length for file size; fail fast for correctness
+                        Write-Error 'Azure Files create operation requires header x-ms-content-length specifying file size in bytes.'
+                        return
+                    } else {
+                        # If body present, assume immediate range upload is intended; advise using comp=range
+                        Write-Verbose 'Body detected on Azure Files PUT without comp=range; consider using comp=range for content upload.'
+                    }
+                }
+            } elseif ($Method -eq 'PUT' -and $isRangeOp) {
+                # Range upload must include x-ms-write and x-ms-range
+                if (-not $RequestHeaders.ContainsKey('x-ms-write')) { $RequestHeaders['x-ms-write'] = 'update' }
+                if (-not $RequestHeaders.ContainsKey('x-ms-range')) {
+                    Write-Error 'Azure Files range upload requires header x-ms-range (e.g., bytes=0-<end>).'
+                    return
+                }
+            }
+        }
+
         # Build canonicalized headers (x-ms-*)
         $CanonicalizedHeaders = Get-CanonicalizedXmsHeaders -Headers $RequestHeaders
 
@@ -557,9 +598,46 @@ function New-CIPPAzStorageRequest {
     } elseif ($Method -eq 'DELETE') {
         # For other DELETE operations across services, prefer capturing headers/status
         $UseInvokeWebRequest = $true
+    } elseif ($Service -eq 'file' -and $Method -eq 'GET' -and -not (($Component -eq 'list') -or ($Uri.Query -match 'comp=list') -or ($Uri.Query -match 'comp=properties') -or ($Uri.Query -match 'comp=metadata'))) {
+        # For Azure Files binary downloads, use Invoke-WebRequest and return bytes
+        $UseInvokeWebRequest = $true
+    } elseif ($Service -eq 'blob' -and $Method -eq 'GET' -and -not (($Component -eq 'list') -or ($Uri.Query -match 'comp=list') -or ($Uri.Query -match 'comp=metadata') -or ($Uri.Query -match 'comp=properties'))) {
+        # For Blob binary downloads, use Invoke-WebRequest and return bytes (memory stream, no filesystem)
+        $UseInvokeWebRequest = $true
     }
     do {
         try {
+            # Blob: binary GET returns bytes from RawContentStream
+            if ($UseInvokeWebRequest -and $Service -eq 'blob' -and $Method -eq 'GET' -and -not (($Component -eq 'list') -or ($Uri.Query -match 'comp=list') -or ($Uri.Query -match 'comp=metadata') -or ($Uri.Query -match 'comp=properties'))) {
+                Write-Verbose 'Processing Blob binary download'
+                $resp = Invoke-WebRequest @RestMethodParams
+                $RequestSuccessful = $true
+                $ms = [System.IO.MemoryStream]::new()
+                try { $resp.RawContentStream.CopyTo($ms) } catch { }
+                $bytes = $ms.ToArray()
+                $hdrHash = @{}
+                if ($resp -and $resp.Headers) { foreach ($key in $resp.Headers.Keys) { $hdrHash[$key] = $resp.Headers[$key] } }
+                $reqUri = $null
+                try { if ($resp -and $resp.BaseResponse -and $resp.BaseResponse.ResponseUri) { $reqUri = $resp.BaseResponse.ResponseUri.AbsoluteUri } } catch { $reqUri = $Uri.AbsoluteUri }
+                return [PSCustomObject]@{ Bytes = $bytes; Length = $bytes.Length; Headers = $hdrHash; Uri = $reqUri }
+            }
+            # Azure Files: binary GET returns bytes
+            if ($UseInvokeWebRequest -and $Service -eq 'file' -and $Method -eq 'GET' -and -not (($Component -eq 'list') -or ($Uri.Query -match 'comp=list') -or ($Uri.Query -match 'comp=properties') -or ($Uri.Query -match 'comp=metadata'))) {
+                Write-Verbose 'Processing Azure Files binary download'
+                $tmp = [System.IO.Path]::GetTempFileName()
+                try {
+                    $resp = Invoke-WebRequest @RestMethodParams -OutFile $tmp
+                    $RequestSuccessful = $true
+                    $bytes = [System.IO.File]::ReadAllBytes($tmp)
+                    $hdrHash = @{}
+                    if ($resp -and $resp.Headers) { foreach ($key in $resp.Headers.Keys) { $hdrHash[$key] = $resp.Headers[$key] } }
+                    $reqUri = $null
+                    try { if ($resp -and $resp.BaseResponse -and $resp.BaseResponse.ResponseUri) { $reqUri = $resp.BaseResponse.ResponseUri.AbsoluteUri } } catch { $reqUri = $Uri.AbsoluteUri }
+                    return [PSCustomObject]@{ Bytes = $bytes; Length = $bytes.Length; Headers = $hdrHash; Uri = $reqUri }
+                } finally {
+                    try { if (Test-Path -LiteralPath $tmp) { Remove-Item -LiteralPath $tmp -Force -ErrorAction SilentlyContinue } } catch {}
+                }
+            }
             # For queue comp=metadata, capture headers-only and return a compact object
             if ($UseInvokeWebRequest -and $Service -eq 'queue' -and (($Component -eq 'metadata') -or ($Uri.Query -match 'comp=metadata'))) {
                 Write-Verbose 'Processing queue metadata response headers'
diff --git a/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1 b/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1
index 1a0836dba0c2..67340eaf3ab5 100644
--- a/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1
@@ -228,7 +228,7 @@ function New-CIPPAlertTemplate {
                     $IntroText = $IntroText + "<p>The (potential) location information for this IP is as follows:</p>$LocationTable"
                 }
                 $IntroText = "$($data.ObjectId) has been added by $($data.UserId)."
-                $ButtonUrl = "$CIPPURL/tenant/administration/enterprise-apps?customerId=?customerId=$($data.OrganizationId)"
+                $ButtonUrl = "$CIPPURL/tenant/administration/applications/enterprise-apps?tenantFilter=$Tenant"
                 $ButtonText = 'Enterprise Apps'
             }
             'Remove service principal.' {
@@ -240,8 +240,8 @@ function New-CIPPAlertTemplate {
                     $LocationTable = ($LocationInfo | ConvertTo-Html -Fragment -As List | Out-String).Replace('<table>', ' <table class="table-modern">')
                     $IntroText = $IntroText + "<p>The (potential) location information for this IP is as follows:</p>$LocationTable"
                 }
-                $IntroText = "$($data.ObjectId) has been added by $($data.UserId)."
-                $ButtonUrl = "$CIPPURL/tenant/administration/enterprise-apps?customerId=?customerId=$($data.OrganizationId)"
+                $IntroText = "$($data.ObjectId) has been removed by $($data.UserId)."
+                $ButtonUrl = "$CIPPURL/tenant/administration/applications/enterprise-apps?tenantFilter=$Tenant"
                 $ButtonText = 'Enterprise Apps'
             }
             'UserLoggedIn' {
diff --git a/Modules/CIPPCore/Public/New-CIPPBackup.ps1 b/Modules/CIPPCore/Public/New-CIPPBackup.ps1
index 728d53a608ba..b3f8409ade3e 100644
--- a/Modules/CIPPCore/Public/New-CIPPBackup.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPBackup.ps1
@@ -1,110 +1,184 @@
 function New-CIPPBackup {
     [CmdletBinding(SupportsShouldProcess = $true)]
     param (
-        $backupType,
+        [Parameter(Mandatory = $true)]
+        [ValidateSet('CIPP', 'Scheduled')]
+        [string]$backupType,
+
         $StorageOutput = 'default',
-        $TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [string]$TenantFilter,
+
         $ScheduledBackupValues,
         $APIName = 'CIPP Backup',
-        $Headers
+        $Headers,
+        [Parameter(Mandatory = $false)] [string] $ConnectionString = $env:AzureWebJobsStorage
     )
 
-    $BackupData = switch ($backupType) {
-        #If backup type is CIPP, create CIPP backup.
-        'CIPP' {
-            try {
-                $BackupTables = @(
-                    'AppPermissions'
-                    'AccessRoleGroups'
-                    'ApiClients'
-                    'CippReplacemap'
-                    'CustomData'
-                    'CustomRoles'
-                    'Config'
-                    'CommunityRepos'
-                    'Domains'
-                    'GraphPresets'
-                    'GDAPRoles'
-                    'GDAPRoleTemplates'
-                    'ExcludedLicenses'
-                    'templates'
-                    'standards'
-                    'SchedulerConfig'
-                    'Extensions'
-                    'WebhookRules'
-                    'ScheduledTasks'
-                    'TenantProperties'
-                )
-                $CSVfile = foreach ($CSVTable in $BackupTables) {
-                    $Table = Get-CippTable -tablename $CSVTable
-                    Get-AzDataTableEntity @Table | Select-Object * -ExcludeProperty DomainAnalyser, table, Timestamp, ETag, Results | Select-Object *, @{l = 'table'; e = { $CSVTable } }
-                }
-                $RowKey = 'CIPPBackup' + '_' + (Get-Date).ToString('yyyy-MM-dd-HHmm')
-                $CSVfile
-                $CSVFile = [string]($CSVfile | ConvertTo-Json -Compress -Depth 100)
-                $entity = @{
-                    PartitionKey = 'CIPPBackup'
-                    RowKey       = [string]$RowKey
-                    TenantFilter = 'CIPPBackup'
-                    Backup       = $CSVfile
-                }
-                $Table = Get-CippTable -tablename 'CIPPBackup'
+    # Validate that TenantFilter is provided for Scheduled backups
+    if ($backupType -eq 'Scheduled' -and [string]::IsNullOrEmpty($TenantFilter)) {
+        throw 'TenantFilter is required for Scheduled backups'
+    }
+
+    $State = 'Backup finished successfully'
+    $RowKey = $null
+    $BackupData = $null
+    $TableName = $null
+    $PartitionKey = $null
+    $ContainerName = $null
+
+    try {
+        switch ($backupType) {
+            #If backup type is CIPP, create CIPP backup.
+            'CIPP' {
                 try {
-                    if ($PSCmdlet.ShouldProcess('CIPP Backup', 'Create')) {
-                        $null = Add-CIPPAzDataTableEntity @Table -Entity $entity -Force
-                        Write-LogMessage -headers $Headers -API $APINAME -message 'Created CIPP Backup' -Sev 'Debug'
+                    $BackupTables = @(
+                        'AppPermissions'
+                        'AccessRoleGroups'
+                        'ApiClients'
+                        'CippReplacemap'
+                        'CustomData'
+                        'CustomRoles'
+                        'Config'
+                        'CommunityRepos'
+                        'Domains'
+                        'GraphPresets'
+                        'GDAPRoles'
+                        'GDAPRoleTemplates'
+                        'ExcludedLicenses'
+                        'templates'
+                        'standards'
+                        'SchedulerConfig'
+                        'Extensions'
+                        'WebhookRules'
+                        'ScheduledTasks'
+                        'TenantProperties'
+                    )
+                    $CSVfile = foreach ($CSVTable in $BackupTables) {
+                        $Table = Get-CippTable -tablename $CSVTable
+                        Get-AzDataTableEntity @Table | Select-Object * -ExcludeProperty DomainAnalyser, table, Timestamp, ETag, Results | Select-Object *, @{l = 'table'; e = { $CSVTable } }
                     }
+                    $RowKey = 'CIPPBackup' + '_' + (Get-Date).ToString('yyyy-MM-dd-HHmm')
+                    $BackupData = [string]($CSVfile | ConvertTo-Json -Compress -Depth 100)
+                    $TableName = 'CIPPBackup'
+                    $PartitionKey = 'CIPPBackup'
+                    $ContainerName = 'cipp-backups'
                 } catch {
                     $ErrorMessage = Get-CippException -Exception $_
-                    Write-LogMessage -headers $Headers -API $APINAME -message "Failed to create backup for CIPP: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
-                    [pscustomobject]@{'Results' = "Backup Creation failed: $($ErrorMessage.NormalizedError)" }
+                    Write-LogMessage -headers $Headers -API $APINAME -message "Failed to create backup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+                    return [pscustomobject]@{'Results' = "Backup Creation failed: $($ErrorMessage.NormalizedError)" }
                 }
-
-            } catch {
-                $ErrorMessage = Get-CippException -Exception $_
-                Write-LogMessage -headers $Headers -API $APINAME -message "Failed to create backup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
-                [pscustomobject]@{'Results' = "Backup Creation failed: $($ErrorMessage.NormalizedError)" }
             }
-        }
 
-        #If Backup type is ConditionalAccess, create Conditional Access backup.
-        'Scheduled' {
-            #Do a sub switch here based on the ScheduledBackupValues?
-            #Store output in tablestorage for Recovery
-            $RowKey = $TenantFilter + '_' + (Get-Date).ToString('yyyy-MM-dd-HHmm')
-            $entity = @{
-                PartitionKey = 'ScheduledBackup'
-                RowKey       = $RowKey
-                TenantFilter = $TenantFilter
-            }
-            Write-Information "Scheduled backup value psproperties: $(([pscustomobject]$ScheduledBackupValues).psobject.Properties)"
-            foreach ($ScheduledBackup in ([pscustomobject]$ScheduledBackupValues).psobject.Properties.Name) {
+            #If Backup type is Scheduled, create Scheduled backup.
+            'Scheduled' {
                 try {
-                    $BackupResult = New-CIPPBackupTask -Task $ScheduledBackup -TenantFilter $TenantFilter | ConvertTo-Json -Depth 100 -Compress | Out-String
-                    $entity[$ScheduledBackup] = "$BackupResult"
+                    $RowKey = $TenantFilter + '_' + (Get-Date).ToString('yyyy-MM-dd-HHmm')
+                    $entity = @{
+                        PartitionKey = 'ScheduledBackup'
+                        RowKey       = $RowKey
+                        TenantFilter = $TenantFilter
+                    }
+                    Write-Information "Scheduled backup value psproperties: $(([pscustomobject]$ScheduledBackupValues).psobject.Properties)"
+                    foreach ($ScheduledBackup in ([pscustomobject]$ScheduledBackupValues).psobject.Properties.Name) {
+                        try {
+                            $BackupResult = New-CIPPBackupTask -Task $ScheduledBackup -TenantFilter $TenantFilter
+                            $entity[$ScheduledBackup] = $BackupResult
+                        } catch {
+                            Write-Information "Failed to create backup for $ScheduledBackup - $($_.Exception.Message)"
+                        }
+                    }
+                    $BackupData = $entity | ConvertTo-Json -Compress -Depth 100
+                    $TableName = 'ScheduledBackup'
+                    $PartitionKey = 'ScheduledBackup'
+                    $ContainerName = 'scheduled-backups'
                 } catch {
-                    Write-Information "Failed to create backup for $ScheduledBackup - $($_.Exception.Message)"
+                    $ErrorMessage = Get-CippException -Exception $_
+                    Write-LogMessage -headers $Headers -API $APINAME -message "Failed to create backup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+                    return [pscustomobject]@{'Results' = "Backup Creation failed: $($ErrorMessage.NormalizedError)" }
                 }
             }
-            $Table = Get-CippTable -tablename 'ScheduledBackup'
+        }
+
+        # Upload backup data to blob storage
+        $blobUrl = $null
+        try {
+            $containers = @()
+            try { $containers = New-CIPPAzStorageRequest -Service 'blob' -Component 'list' -ConnectionString $ConnectionString } catch { $containers = @() }
+            $exists = ($containers | Where-Object { $_.Name -eq $ContainerName }) -ne $null
+            if (-not $exists) {
+                $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $ContainerName -Method 'PUT' -QueryParams @{ restype = 'container' } -ConnectionString $ConnectionString
+                Start-Sleep -Milliseconds 500
+            }
+            $blobName = "$RowKey.json"
+            $resourcePath = "$ContainerName/$blobName"
+            $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $resourcePath -Method 'PUT' -ContentType 'application/json; charset=utf-8' -Body $BackupData -ConnectionString $ConnectionString
+
+            # Build full blob URL for storage in table
             try {
-                measure-cipptask -TaskName 'ScheduledBackupStorage' -EventName 'CIPP.BackupCompleted' -Script {
-                    $null = Add-CIPPAzDataTableEntity @Table -entity $entity -Force
+                $csParts = @{}
+                foreach ($p in ($ConnectionString -split ';')) {
+                    if (-not [string]::IsNullOrWhiteSpace($p)) {
+                        $kv = $p -split '=', 2
+                        if ($kv.Length -eq 2) { $csParts[$kv[0]] = $kv[1] }
+                    }
+                }
+
+                # Handle UseDevelopmentStorage=true (Azurite)
+                if ($csParts.ContainsKey('UseDevelopmentStorage') -and $csParts['UseDevelopmentStorage'] -eq 'true') {
+                    $base = 'http://127.0.0.1:10000/devstoreaccount1'
+                } elseif ($csParts.ContainsKey('BlobEndpoint') -and $csParts['BlobEndpoint']) {
+                    $base = ($csParts['BlobEndpoint']).TrimEnd('/')
+                } else {
+                    $protocol = if ($csParts.ContainsKey('DefaultEndpointsProtocol') -and $csParts['DefaultEndpointsProtocol']) { $csParts['DefaultEndpointsProtocol'] } else { 'https' }
+                    $suffix = if ($csParts.ContainsKey('EndpointSuffix') -and $csParts['EndpointSuffix']) { $csParts['EndpointSuffix'] } else { 'core.windows.net' }
+                    $acct = $csParts['AccountName']
+                    if (-not $acct) { throw 'AccountName missing in ConnectionString' }
+                    $base = "$protocol`://$acct.blob.$suffix"
                 }
-                Write-LogMessage -headers $Headers -API $APINAME -message 'Created backup' -Sev 'Debug'
-                $State = 'Backup finished successfully'
+                $blobUrl = "$base/$resourcePath"
             } catch {
-                $State = 'Failed to write backup to table storage'
-                $ErrorMessage = Get-CippException -Exception $_
-                Write-LogMessage -headers $Headers -API $APINAME -message "Failed to create tenant backup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
-                [pscustomobject]@{'Results' = "Backup Creation failed: $($ErrorMessage.NormalizedError)" }
+                # If building full URL fails, fall back to resource path
+                $blobUrl = $resourcePath
             }
+        } catch {
+            $ErrorMessage = Get-CippException -Exception $_
+            Write-LogMessage -headers $Headers -API $APINAME -message "Blob upload failed: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
         }
 
+        # Write table entity pointing to blob resource
+        $entity = @{
+            PartitionKey = $PartitionKey
+            RowKey       = [string]$RowKey
+            Backup       = $blobUrl
+            BackupIsBlob = $true
+        }
+
+        if ($TenantFilter) {
+            $entity['TenantFilter'] = $TenantFilter
+        }
+
+        $Table = Get-CippTable -tablename $TableName
+        try {
+            if ($PSCmdlet.ShouldProcess("$backupType Backup", 'Create')) {
+                $null = Add-CIPPAzDataTableEntity @Table -Entity $entity -Force
+                Write-LogMessage -headers $Headers -API $APINAME -message "Created $backupType Backup (link stored)" -Sev 'Debug'
+            }
+        } catch {
+            $ErrorMessage = Get-CippException -Exception $_
+            Write-LogMessage -headers $Headers -API $APINAME -message "Failed to create backup for $backupType : $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+            return [pscustomobject]@{'Results' = "Backup Creation failed: $($ErrorMessage.NormalizedError)" }
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Headers -API $APINAME -message "Failed to create backup: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return [pscustomobject]@{'Results' = "Backup Creation failed: $($ErrorMessage.NormalizedError)" }
+    }
+
+    return [pscustomobject]@{
+        BackupName  = $RowKey
+        BackupState = $State
     }
-    return @([pscustomobject]@{
-            BackupName  = $RowKey
-            BackupState = $State
-        })
 }
 
diff --git a/Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1 b/Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1
index 27ce66d595f7..250b31296dd8 100644
--- a/Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1
@@ -89,14 +89,14 @@ function New-CIPPCAPolicy {
         $UserIds = [System.Collections.Generic.List[string]]::new()
         $userNames | ForEach-Object {
             if (Test-IsGuid $_) {
-                Write-LogMessage -Headers $User -API 'Create CA Policy' -message "Already GUID, no need to replace: $_" -Sev 'Debug'
+                Write-LogMessage -Headers $Headers -API 'Create CA Policy' -message "Already GUID, no need to replace: $_" -Sev 'Debug'
                 $UserIds.Add($_) # it's a GUID, so we keep it
             } else {
                 $userId = ($users | Where-Object -Property displayName -EQ $_).id # it's a display name, so we get the user ID
                 if ($userId) {
                     foreach ($uid in $userId) {
                         Write-Warning "Replaced user name $_ with ID $uid"
-                        $null = Write-LogMessage -Headers $User -API 'Create CA Policy' -message "Replaced user name $_ with ID $uid" -Sev 'Debug'
+                        $null = Write-LogMessage -Headers $Headers -API 'Create CA Policy' -message "Replaced user name $_ with ID $uid" -Sev 'Debug'
                         $UserIds.Add($uid) # add the ID to the list
                     }
                 } else {
@@ -135,7 +135,7 @@ function New-CIPPCAPolicy {
             $Body = ConvertTo-Json -InputObject $JSONobj.GrantControls.authenticationStrength
             $GraphRequest = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrength/policies' -body $body -Type POST -tenantid $tenantfilter -asApp $true
             $JSONobj.GrantControls.authenticationStrength = @{ id = $ExistingStrength.id }
-            Write-LogMessage -Headers $User -API $APINAME -message "Created new Authentication Strength Policy: $($JSONobj.GrantControls.authenticationStrength.displayName)" -Sev 'Info'
+            Write-LogMessage -Headers $Headers -API $APINAME -message "Created new Authentication Strength Policy: $($JSONobj.GrantControls.authenticationStrength.displayName)" -Sev 'Info'
         }
     }
 
@@ -144,10 +144,12 @@ function New-CIPPCAPolicy {
     if (($JSONobj.conditions.applications.includeApplications -and $JSONobj.conditions.applications.includeApplications -notcontains 'All') -or ($JSONobj.conditions.applications.excludeApplications -and $JSONobj.conditions.applications.excludeApplications -notcontains 'All')) {
         $AllServicePrincipals = New-GraphGETRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals?$select=appId' -tenantid $TenantFilter -asApp $true
 
+        $ReservedApplicationNames = @('none', 'All', 'Office365', 'MicrosoftAdminPortals')
+
         if ($JSONobj.conditions.applications.excludeApplications -and $JSONobj.conditions.applications.excludeApplications -notcontains 'All') {
             $ValidExclusions = [system.collections.generic.list[string]]::new()
             foreach ($appId in $JSONobj.conditions.applications.excludeApplications) {
-                if ($AllServicePrincipals.appId -contains $appId) {
+                if ($AllServicePrincipals.appId -contains $appId -or $ReservedApplicationNames -contains $appId) {
                     $ValidExclusions.Add($appId)
                 }
             }
@@ -156,7 +158,7 @@ function New-CIPPCAPolicy {
         if ($JSONobj.conditions.applications.includeApplications -and $JSONobj.conditions.applications.includeApplications -notcontains 'All') {
             $ValidInclusions = [system.collections.generic.list[string]]::new()
             foreach ($appId in $JSONobj.conditions.applications.includeApplications) {
-                if ($AllServicePrincipals.appId -contains $appId) {
+                if ($AllServicePrincipals.appId -contains $appId -or $ReservedApplicationNames -contains $appId) {
                     $ValidInclusions.Add($appId)
                 }
             }
@@ -171,13 +173,26 @@ function New-CIPPCAPolicy {
             if (!$location.displayName) { continue }
             $CheckExisting = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations' -tenantid $TenantFilter -asApp $true
             if ($Location.displayName -in $CheckExisting.displayName) {
+                $ExistingLocation = $CheckExisting | Where-Object -Property displayName -EQ $Location.displayName
+                if ($Overwrite) {
+                    $LocationUpdate = $location | Select-Object * -ExcludeProperty id
+                    Remove-ODataProperties -Object $LocationUpdate
+                    $Body = ConvertTo-Json -InputObject $LocationUpdate -Depth 10
+                    try {
+                        $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations/$($ExistingLocation.id)" -body $body -Type PATCH -tenantid $tenantfilter -asApp $true
+                        Write-LogMessage -Tenant $TenantFilter -Headers $Headers -API $APINAME -message "Updated existing Named Location: $($location.displayName)" -Sev 'Info'
+                    } catch {
+                        Write-Warning "Failed to update location $($location.displayName): $_"
+                        Write-LogMessage -Tenant $TenantFilter -Headers $Headers -API $APINAME -message "Failed to update existing Named Location: $($location.displayName). Error: $_" -Sev 'Error'
+                    }
+                } else {
+                    Write-LogMessage -Tenant $TenantFilter -Headers $Headers -API $APINAME -message "Matched a CA policy with the existing Named Location: $($location.displayName)" -Sev 'Info'
+                }
                 [pscustomobject]@{
-                    id         = ($CheckExisting | Where-Object -Property displayName -EQ $Location.displayName).id
-                    name       = ($CheckExisting | Where-Object -Property displayName -EQ $Location.displayName).displayName
-                    templateId = $location.id
+                    id          = $ExistingLocation.id
+                    name        = $ExistingLocation.displayName
+                    templateId  = $location.id
                 }
-                Write-LogMessage -Tenant $TenantFilter -Headers $User -API $APINAME -message "Matched a CA policy with the existing Named Location: $($location.displayName)" -Sev 'Info'
-
             } else {
                 if ($location.countriesAndRegions) { $location.countriesAndRegions = @($location.countriesAndRegions) }
                 $location | Select-Object * -ExcludeProperty id
@@ -192,7 +207,7 @@ function New-CIPPCAPolicy {
                     Start-Sleep -Seconds 2
                     $retryCount++
                 } while ((!$LocationRequest -or !$LocationRequest.id) -and ($retryCount -lt 5))
-                Write-LogMessage -Tenant $TenantFilter -Headers $User -API $APINAME -message "Created new Named Location: $($location.displayName)" -Sev 'Info'
+                Write-LogMessage -Tenant $TenantFilter -Headers $Headers -API $APINAME -message "Created new Named Location: $($location.displayName)" -Sev 'Info'
                 [pscustomobject]@{
                     id   = $GraphRequest.id
                     name = $GraphRequest.displayName
@@ -304,7 +319,7 @@ function New-CIPPCAPolicy {
         $body = '{ "isEnabled": false }'
         try {
             $null = New-GraphPostRequest -tenantid $TenantFilter -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -Type patch -Body $body -asApp $true -ContentType 'application/json'
-            Write-LogMessage -Headers $User -API 'Create CA Policy' -tenant $TenantFilter -message "Disabled Security Defaults for tenant $($TenantFilter)" -Sev 'Info'
+            Write-LogMessage -Headers $Headers -API 'Create CA Policy' -tenant $TenantFilter -message "Disabled Security Defaults for tenant $($TenantFilter)" -Sev 'Info'
             Start-Sleep 3
         } catch {
             $ErrorMessage = Get-CippException -Exception $_
@@ -351,7 +366,7 @@ function New-CIPPCAPolicy {
                 }
                 Write-Information "overwriting $($CheckExisting.id)"
                 $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/identity/conditionalAccess/policies/$($CheckExisting.id)" -tenantid $tenantfilter -type PATCH -body $RawJSON -asApp $true
-                Write-LogMessage -Headers $User -API 'Create CA Policy' -tenant $($Tenant) -message "Updated Conditional Access Policy $($JSONobj.Displayname) to the template standard." -Sev 'Info'
+                Write-LogMessage -Headers $Headers -API 'Create CA Policy' -tenant $($Tenant) -message "Updated Conditional Access Policy $($JSONobj.Displayname) to the template standard." -Sev 'Info'
                 return "Updated policy $displayname for $tenantfilter"
             }
         } else {
@@ -360,7 +375,7 @@ function New-CIPPCAPolicy {
                 Start-Sleep 3
             }
             $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies' -tenantid $tenantfilter -type POST -body $RawJSON -asApp $true
-            Write-LogMessage -Headers $User -API 'Create CA Policy' -tenant $($Tenant) -message "Added Conditional Access Policy $($JSONobj.Displayname)" -Sev 'Info'
+            Write-LogMessage -Headers $Headers -API 'Create CA Policy' -tenant $($Tenant) -message "Added Conditional Access Policy $($JSONobj.Displayname)" -Sev 'Info'
             return "Created policy $displayname for $tenantfilter"
         }
     } catch {
diff --git a/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1 b/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1
index 8d0c7d86ba7a..060b91863208 100644
--- a/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPCATemplate.ps1
@@ -56,7 +56,14 @@ function New-CIPPCATemplate {
     }
 
     if ($excludelocations) { $JSON.conditions.locations.excludeLocations = $excludelocations }
-    if ($JSON.conditions.users.includeUsers) {
+    # Check if conditions.users exists and is a PSCustomObject (not an array) before accessing properties
+    $hasConditionsUsers = $null -ne $JSON.conditions.users
+    # Explicitly exclude array types - arrays have properties but we can't set custom properties on them
+    $isArray = $hasConditionsUsers -and ($JSON.conditions.users -is [Array] -or $JSON.conditions.users -is [System.Collections.IList])
+    $isPSCustomObject = $hasConditionsUsers -and -not $isArray -and ($JSON.conditions.users -is [PSCustomObject] -or ($JSON.conditions.users.PSObject.Properties.Count -gt 0 -and -not $isArray))
+    $hasIncludeUsers = $isPSCustomObject -and ($null -ne $JSON.conditions.users.includeUsers)
+
+    if ($isPSCustomObject -and $hasIncludeUsers) {
         $JSON.conditions.users.includeUsers = @($JSON.conditions.users.includeUsers | ForEach-Object {
                 $originalID = $_
                 if ($_ -in 'All', 'None', 'GuestOrExternalUsers') { return $_ }
@@ -65,7 +72,8 @@ function New-CIPPCATemplate {
             })
     }
 
-    if ($JSON.conditions.users.excludeUsers) {
+    # Use the same type check for other user properties
+    if ($isPSCustomObject -and $null -ne $JSON.conditions.users.excludeUsers) {
         $JSON.conditions.users.excludeUsers = @($JSON.conditions.users.excludeUsers | ForEach-Object {
                 if ($_ -in 'All', 'None', 'GuestOrExternalUsers') { return $_ }
                 $originalID = $_
@@ -74,7 +82,7 @@ function New-CIPPCATemplate {
             })
     }
 
-    if ($JSON.conditions.users.includeGroups) {
+    if ($isPSCustomObject -and $null -ne $JSON.conditions.users.includeGroups) {
         $JSON.conditions.users.includeGroups = @($JSON.conditions.users.includeGroups | ForEach-Object {
                 $originalID = $_
                 if ($_ -in 'All', 'None', 'GuestOrExternalUsers' -or -not (Test-IsGuid $_)) { return $_ }
@@ -82,7 +90,7 @@ function New-CIPPCATemplate {
                 if ($match) { $match.displayName } else { $originalID }
             })
     }
-    if ($JSON.conditions.users.excludeGroups) {
+    if ($isPSCustomObject -and $null -ne $JSON.conditions.users.excludeGroups) {
         $JSON.conditions.users.excludeGroups = @($JSON.conditions.users.excludeGroups | ForEach-Object {
                 $originalID = $_
                 if ($_ -in 'All', 'None', 'GuestOrExternalUsers' -or -not (Test-IsGuid $_)) { return $_ }
@@ -98,7 +106,9 @@ function New-CIPPCATemplate {
         $AllLocations.Add($Location)
     }
 
-    $JSON | Add-Member -NotePropertyName 'LocationInfo' -NotePropertyValue @($AllLocations | Select-Object -Unique) -Force
+    # Remove duplicates based on displayName to avoid Select-Object -Unique issues with complex objects
+    $UniqueLocations = $AllLocations | Group-Object -Property displayName | ForEach-Object { $_.Group[0] }
+    $JSON | Add-Member -NotePropertyName 'LocationInfo' -NotePropertyValue @($UniqueLocations) -Force
     $JSON = (ConvertTo-Json -Compress -Depth 100 -InputObject $JSON)
     return $JSON
 }
diff --git a/Modules/CIPPCore/Public/New-CIPPDbRequest.ps1 b/Modules/CIPPCore/Public/New-CIPPDbRequest.ps1
new file mode 100644
index 000000000000..12a484544079
--- /dev/null
+++ b/Modules/CIPPCore/Public/New-CIPPDbRequest.ps1
@@ -0,0 +1,46 @@
+function New-CIPPDbRequest {
+    <#
+    .SYNOPSIS
+        Query the CIPP Reporting database by partition key
+
+    .DESCRIPTION
+        Retrieves data from the CippReportingDB table filtered by partition key (tenant)
+
+    .PARAMETER TenantFilter
+        The tenant domain or GUID to filter by (used as partition key)
+
+    .PARAMETER Type
+        Optional. The data type to filter by (e.g., Users, Groups, Devices)
+
+    .EXAMPLE
+        New-CIPPDbRequest -TenantFilter 'contoso.onmicrosoft.com'
+
+    .EXAMPLE
+        New-CIPPDbRequest -TenantFilter 'contoso.onmicrosoft.com' -Type 'Users'
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Type
+    )
+
+    try {
+        $Table = Get-CippTable -tablename 'CippReportingDB'
+
+        if ($Type) {
+            $Filter = "PartitionKey eq '{0}' and RowKey ge '{1}-' and RowKey lt '{1}.'" -f $TenantFilter, $Type
+        } else {
+            $Filter = "PartitionKey eq '{0}'" -f $TenantFilter
+        }
+
+        $Results = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+
+        return ($Results.Data | ConvertFrom-Json -ErrorAction SilentlyContinue)
+    } catch {
+        Write-LogMessage -API 'CIPPDbRequest' -tenant $TenantFilter -message "Failed to query database: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/New-CIPPRestore.ps1 b/Modules/CIPPCore/Public/New-CIPPRestore.ps1
index 52042e261780..5668b3f48484 100644
--- a/Modules/CIPPCore/Public/New-CIPPRestore.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPRestore.ps1
@@ -10,7 +10,8 @@ function New-CIPPRestore {
 
     Write-Host "Scheduled Restore psproperties: $(([pscustomobject]$RestoreValues).psobject.Properties)"
     Write-LogMessage -headers $Headers -API $APINAME -message 'Restored backup' -Sev 'Debug'
-    $RestoreData = foreach ($ScheduledBackup in ([pscustomobject]$RestoreValues).psobject.Properties.Name | Where-Object { $_ -notin 'email', 'webhook', 'psa', 'backup', 'overwrite' }) {
+    $RestoreData = foreach ($ScheduledBackup in ([pscustomobject]$RestoreValues).psobject.Properties | Where-Object { $_.Value -eq $true -and $_.Name -notin 'email', 'webhook', 'psa', 'backup', 'overwrite' } | Select-Object -ExpandProperty Name) {
+        Write-Information "Restoring $ScheduledBackup for tenant $TenantFilter"
         New-CIPPRestoreTask -Task $ScheduledBackup -TenantFilter $TenantFilter -backup $RestoreValues.backup -overwrite $RestoreValues.overwrite -Headers $Headers -APIName $APIName
     }
     return $RestoreData
diff --git a/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1 b/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1
index 2e19b3f3f0a2..aec6db68de03 100644
--- a/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1
@@ -8,13 +8,67 @@ function New-CIPPRestoreTask {
         $APINAME,
         $Headers
     )
-    $Table = Get-CippTable -tablename 'ScheduledBackup'
-    $BackupData = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$backup'"
-    $RestoreData = switch ($Task) {
+    # Use Get-CIPPBackup which handles blob storage fetching
+    $BackupData = Get-CIPPBackup -Type 'Scheduled' -Name $backup
+
+    # If this is a blob-based backup, parse the Backup property to get the actual data structure
+    if ($BackupData.BackupIsBlob -or $BackupData.BackupIsBlobLink) {
+        try {
+            $BackupData = $BackupData.Backup | ConvertFrom-Json
+        } catch {
+            Write-Warning "Failed to parse blob backup data: $($_.Exception.Message)"
+        }
+    }
+
+
+    # Initialize restoration counters
+    $restorationStats = @{
+        'CustomVariables'   = @{ success = 0; failed = 0 }
+        'Users'             = @{ success = 0; failed = 0 }
+        'Groups'            = @{ success = 0; failed = 0 }
+        'ConditionalAccess' = @{ success = 0; failed = 0 }
+        'IntuneConfig'      = @{ success = 0; failed = 0 }
+        'IntunCompliance'   = @{ success = 0; failed = 0 }
+        'IntuneProtection'  = @{ success = 0; failed = 0 }
+        'AntiSpam'          = @{ success = 0; failed = 0 }
+        'AntiPhishing'      = @{ success = 0; failed = 0 }
+        'WebhookAlerts'     = @{ success = 0; failed = 0 }
+        'ScriptedAlerts'    = @{ success = 0; failed = 0 }
+    }
+
+    # Helper function to clean user object for Graph API - removes reference properties, nulls, and empty strings
+    function Clean-GraphObject {
+        param($Object, [switch]$ExcludeId)
+        $excludeProps = @('password', 'passwordProfile', '@odata.type', 'manager', 'memberOf', 'createdOnBehalfOf', 'createdByAppId', 'deletedDateTime', 'authorizationInfo')
+        if ($ExcludeId) {
+            $excludeProps += @('id')
+        }
+
+        $cleaned = $Object | Select-Object * -ExcludeProperty $excludeProps
+        $result = @{}
+
+        foreach ($prop in $cleaned.PSObject.Properties) {
+            $propValue = $prop.Value
+            # Skip empty strings, nulls, and complex objects (except known-good arrays like businessPhones)
+            if ($propValue -ne '' -and $null -ne $propValue) {
+                # Skip complex objects/dictionaries but allow simple arrays
+                if ($propValue -is [System.Collections.IDictionary]) {
+                    continue
+                }
+                $result[$prop.Name] = $propValue
+            }
+        }
+
+        return $result
+    }
+
+    $RestoreData = [System.Collections.Generic.List[string]]::new()
+
+    switch ($Task) {
         'CippCustomVariables' {
             Write-Host "Restore Custom Variables for $TenantFilter"
             $ReplaceTable = Get-CIPPTable -TableName 'CippReplacemap'
-            $Backup = $BackupData.CippCustomVariables | ConvertFrom-Json
+            $Backup = if ($BackupData.CippCustomVariables -is [string]) { $BackupData.CippCustomVariables | ConvertFrom-Json } else { $BackupData.CippCustomVariables }
 
             $Tenant = Get-Tenants -TenantFilter $TenantFilter
             $CustomerId = $Tenant.customerId
@@ -28,68 +82,122 @@ function New-CIPPRestoreTask {
                         Description  = $variable.Description
                     }
 
-                    if ($overwrite) {
-                        Add-CIPPAzDataTableEntity @ReplaceTable -Entity $entity -Force
-                        Write-LogMessage -message "Restored custom variable $($variable.RowKey) from backup" -Sev 'info'
-                        "Restored custom variable $($variable.RowKey) from backup"
-                    } else {
-                        # Check if variable already exists
-                        $existing = Get-CIPPAzDataTableEntity @ReplaceTable -Filter "PartitionKey eq '$CustomerId' and RowKey eq '$($variable.RowKey)'"
-                        if (!$existing) {
+                    try {
+                        if ($overwrite) {
                             Add-CIPPAzDataTableEntity @ReplaceTable -Entity $entity -Force
                             Write-LogMessage -message "Restored custom variable $($variable.RowKey) from backup" -Sev 'info'
-                            "Restored custom variable $($variable.RowKey) from backup"
+                            $restorationStats['CustomVariables'].success++
+                            $RestoreData.Add("Restored custom variable $($variable.RowKey) from backup")
                         } else {
-                            Write-LogMessage -message "Custom variable $($variable.RowKey) already exists and overwrite is disabled" -Sev 'info'
-                            "Custom variable $($variable.RowKey) already exists and overwrite is disabled"
+                            # Check if variable already exists
+                            $existing = Get-CIPPAzDataTableEntity @ReplaceTable -Filter "PartitionKey eq '$CustomerId' and RowKey eq '$($variable.RowKey)'"
+                            if (!$existing) {
+                                Add-CIPPAzDataTableEntity @ReplaceTable -Entity $entity -Force
+                                Write-LogMessage -message "Restored custom variable $($variable.RowKey) from backup" -Sev 'info'
+                                $restorationStats['CustomVariables'].success++
+                                $RestoreData.Add("Restored custom variable $($variable.RowKey) from backup")
+                            } else {
+                                Write-LogMessage -message "Custom variable $($variable.RowKey) already exists and overwrite is disabled" -Sev 'info'
+                                $RestoreData.Add("Custom variable $($variable.RowKey) already exists and overwrite is disabled")
+                            }
                         }
+                    } catch {
+                        $restorationStats['CustomVariables'].failed++
+                        Write-LogMessage -message "Failed to restore custom variable $($variable.RowKey): $($_.Exception.Message)" -Sev 'Warning'
+                        $RestoreData.Add("Failed to restore custom variable $($variable.RowKey)")
                     }
                 }
             } catch {
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-                "Could not restore Custom Variables: $ErrorMessage"
+                $RestoreData.Add("Could not restore Custom Variables: $ErrorMessage")
                 Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Custom Variables: $ErrorMessage" -Sev 'Error'
             }
         }
         'users' {
             $currentUsers = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/users?$top=999&select=id,userPrincipalName' -tenantid $TenantFilter
-            $backupUsers = $BackupData.users | ConvertFrom-Json
+            $backupUsers = if ($BackupData.users -is [string]) { $BackupData.users | ConvertFrom-Json } else { $BackupData.users }
+
+            Write-Host "Restore users for $TenantFilter"
+            Write-Information "User count in backup: $($backupUsers.Count)"
             $BackupUsers | ForEach-Object {
                 try {
-                    $JSON = $_ | ConvertTo-Json -Depth 100 -Compress
-                    $DisplayName = $_.displayName
-                    $UPN = $_.userPrincipalName
+                    $userObject = $_
+                    $UPN = $userObject.userPrincipalName
+
                     if ($overwrite) {
-                        if ($_.id -in $currentUsers.id) {
-                            New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/users/$($_.id)" -tenantid $TenantFilter -body $JSON -type PATCH
+                        if ($userObject.id -in $currentUsers.id -or $userObject.userPrincipalName -in $currentUsers.userPrincipalName) {
+                            # Patch existing user - clean object to remove reference properties, nulls, and empty strings
+                            $cleanedUser = Clean-GraphObject -Object $userObject
+                            $patchBody = $cleanedUser | ConvertTo-Json -Depth 100 -Compress
+                            $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/users/$($userObject.id)" -tenantid $TenantFilter -body $patchBody -type PATCH
                             Write-LogMessage -message "Restored $($UPN) from backup by patching the existing object." -Sev 'info'
-                            "The user existed. Restored $($UPN) from backup"
+                            $restorationStats['Users'].success++
+                            $RestoreData.Add("The user existed. Restored $($UPN) from backup")
                         } else {
-                            New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/users' -tenantid $TenantFilter -body $JSON -type POST
-                            Write-LogMessage -message "Restored $($UPN) from backup by creating a new object." -Sev 'info'
-                            "The user did not exist. Restored $($UPN) from backup"
+                            # Create new user - need to add password and clean object
+                            $tempPassword = New-passwordString
+                            # Remove reference properties that may not exist in target tenant, nulls, and empty strings
+                            $cleanedUser = Clean-GraphObject -Object $userObject -ExcludeId
+                            $cleanedUser['passwordProfile'] = @{
+                                'forceChangePasswordNextSignIn' = $true
+                                'password'                      = $tempPassword
+                            }
+                            $JSON = $cleanedUser | ConvertTo-Json -Depth 100 -Compress
+
+                            $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/users' -tenantid $TenantFilter -body $JSON -type POST
+                            # Try to wrap password in PwPush link
+                            $displayPassword = $tempPassword
+                            try {
+                                $PasswordLink = New-PwPushLink -Payload $tempPassword
+                                if ($PasswordLink) {
+                                    $displayPassword = $PasswordLink
+                                }
+                            } catch {
+                                # If PwPush fails, use plain password
+                            }
+                            Write-LogMessage -message "Restored $($UPN) from backup by creating a new object with temporary password. Password: $displayPassword" -Sev 'info' -tenant $TenantFilter
+                            $restorationStats['Users'].success++
+                            $RestoreData.Add("The user did not exist. Restored $($UPN) from backup with temporary password: $displayPassword")
                         }
                     }
                     if (!$overwrite) {
-                        if ($_.id -notin $backupUsers.id) {
-                            New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/users' -tenantid $TenantFilter -body $JSON -type POST
-                            Write-LogMessage -message "Restored $($UPN) from backup" -Sev 'info'
-                            "Restored $($UPN) from backup"
-                        } else {
-                            Write-LogMessage -message "User $($UPN) already exists in tenant $TenantFilter and overwrite is disabled" -Sev 'info'
-                            "User $($UPN) already exists in tenant $TenantFilter and overwrite is disabled"
+                        if ($userObject.id -notin $currentUsers.id -and $userObject.userPrincipalName -notin $currentUsers.userPrincipalName) {
+                            # Create new user - need to add password and clean object
+                            $tempPassword = New-passwordString
+                            # Remove reference properties that may not exist in target tenant, nulls, and empty strings
+                            $cleanedUser = Clean-GraphObject -Object $userObject -ExcludeId
+                            $cleanedUser['passwordProfile'] = @{
+                                'forceChangePasswordNextSignIn' = $true
+                                'password'                      = $tempPassword
+                            }
+                            $JSON = $cleanedUser | ConvertTo-Json -Depth 100 -Compress
+                            $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/users' -tenantid $TenantFilter -body $JSON -type POST
+                            # Try to wrap password in PwPush link
+                            $displayPassword = $tempPassword
+                            try {
+                                $PasswordLink = New-PwPushLink -Payload $tempPassword
+                                if ($PasswordLink) {
+                                    $displayPassword = $PasswordLink
+                                }
+                            } catch {
+                                # If PwPush fails, use plain password
+                            }
+                            Write-LogMessage -message "Restored $($UPN) from backup with temporary password. Password: $displayPassword" -Sev 'info'
+                            $restorationStats['Users'].success++
+                            $RestoreData.Add("Restored $($UPN) from backup with temporary password: $displayPassword")
                         }
                     }
                 } catch {
+                    $restorationStats['Users'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore user $($UPN): $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore user $($UPN): $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore user $($UPN): $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
         }
         'groups' {
             Write-Host "Restore groups for $TenantFilter"
-            $backupGroups = $BackupData.groups | ConvertFrom-Json
+            $backupGroups = if ($BackupData.groups -is [string]) { $BackupData.groups | ConvertFrom-Json } else { $BackupData.groups }
             $Groups = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999' -tenantid $TenantFilter
             $BackupGroups | ForEach-Object {
                 try {
@@ -97,67 +205,77 @@ function New-CIPPRestoreTask {
                     $DisplayName = $_.displayName
                     if ($overwrite) {
                         if ($_.id -in $Groups.id) {
-                            New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/groups/$($_.id)" -tenantid $TenantFilter -body $JSON -type PATCH
+                            $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/groups/$($_.id)" -tenantid $TenantFilter -body $JSON -type PATCH
                             Write-LogMessage -message "Restored $DisplayName from backup by patching the existing object." -Sev 'info'
-                            "The group existed. Restored $DisplayName from backup"
+                            $restorationStats['Groups'].success++
+                            $RestoreData.Add("The group existed. Restored $DisplayName from backup")
                         } else {
-                            New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $TenantFilter -body $JSON -type POST
+                            $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $TenantFilter -body $JSON -type POST
                             Write-LogMessage -message "Restored $DisplayName from backup" -Sev 'info'
-                            "Restored $DisplayName from backup"
+                            $restorationStats['Groups'].success++
+                            $RestoreData.Add("Restored $DisplayName from backup")
                         }
                     }
                     if (!$overwrite) {
                         if ($_.id -notin $Groups.id) {
-                            New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $TenantFilter -body $JSON -type POST
+                            $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $TenantFilter -body $JSON -type POST
                             Write-LogMessage -message "Restored $DisplayName from backup" -Sev 'info'
-                            "Restored $DisplayName from backup"
+                            $restorationStats['Groups'].success++
+                            $RestoreData.Add("Restored $DisplayName from backup")
                         } else {
                             Write-LogMessage -message "Group $DisplayName already exists in tenant $TenantFilter and overwrite is disabled" -Sev 'info'
-                            "Group $DisplayName already exists in tenant $TenantFilter and overwrite is disabled"
+                            $RestoreData.Add("Group $DisplayName already exists in tenant $TenantFilter and overwrite is disabled")
                         }
                     }
                 } catch {
+                    $restorationStats['Groups'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore group $DisplayName : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore group $DisplayName : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore group $DisplayName : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
         }
         'ca' {
             Write-Host "Restore Conditional Access Policies for $TenantFilter"
-            $BackupCAPolicies = $BackupData.ca | ConvertFrom-Json
+            $BackupCAPolicies = if ($BackupData.ca -is [string]) { $BackupData.ca | ConvertFrom-Json } else { $BackupData.ca }
             $BackupCAPolicies | ForEach-Object {
                 $JSON = $_
                 try {
-                    New-CIPPCAPolicy -replacePattern 'displayName' -Overwrite $overwrite -TenantFilter $TenantFilter -state 'donotchange' -RawJSON $JSON -APIName 'CIPP Restore' -ErrorAction SilentlyContinue
+                    $null = New-CIPPCAPolicy -replacePattern 'displayName' -Overwrite $overwrite -TenantFilter $TenantFilter -state 'donotchange' -RawJSON $JSON -APIName 'CIPP Restore' -ErrorAction SilentlyContinue
+                    $restorationStats['ConditionalAccess'].success++
+                    $RestoreData.Add('Restored Conditional Access policy from backup')
                 } catch {
+                    $restorationStats['ConditionalAccess'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Conditional Access Policy $DisplayName : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Conditional Access Policy $DisplayName : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Conditional Access Policy $DisplayName : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
         }
         'intuneconfig' {
-            $BackupConfig = $BackupData.intuneconfig | ConvertFrom-Json
+            $BackupConfig = if ($BackupData.intuneconfig -is [string]) { $BackupData.intuneconfig | ConvertFrom-Json } else { $BackupData.intuneconfig }
             foreach ($backup in $backupConfig) {
                 try {
-                    Set-CIPPIntunePolicy -TemplateType $backup.Type -TenantFilter $TenantFilter -DisplayName $backup.DisplayName -Description $backup.Description -RawJSON ($backup.TemplateJson) -Headers $Headers -APINAME $APINAME -ErrorAction SilentlyContinue
+                    $null = Set-CIPPIntunePolicy -TemplateType $backup.Type -TenantFilter $TenantFilter -DisplayName $backup.DisplayName -Description $backup.Description -RawJSON ($backup.TemplateJson) -Headers $Headers -APINAME $APINAME -ErrorAction SilentlyContinue
                 } catch {
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Intune Configuration $DisplayName : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Intune Configuration $DisplayName : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Intune Configuration $DisplayName : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
             #Convert the manual method to a function
         }
         'intunecompliance' {
-            $BackupConfig = $BackupData.intunecompliance | ConvertFrom-Json
+            $BackupConfig = if ($BackupData.intunecompliance -is [string]) { $BackupData.intunecompliance | ConvertFrom-Json } else { $BackupData.intunecompliance }
             foreach ($backup in $backupConfig) {
                 try {
-                    Set-CIPPIntunePolicy -TemplateType $backup.Type -TenantFilter $TenantFilter -DisplayName $backup.DisplayName -Description $backup.Description -RawJSON ($backup.TemplateJson) -Headers $Headers -APINAME $APINAME -ErrorAction SilentlyContinue
+                    $null = Set-CIPPIntunePolicy -TemplateType $backup.Type -TenantFilter $TenantFilter -DisplayName $backup.DisplayName -Description $backup.Description -RawJSON ($backup.TemplateJson) -Headers $Headers -APINAME $APINAME -ErrorAction SilentlyContinue
+                    $restorationStats['IntuneConfig'].success++
+                    $RestoreData.Add('Restored Intune configuration from backup')
                 } catch {
+                    $restorationStats['IntuneConfig'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Intune Compliance $DisplayName : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Intune Compliance $DisplayName : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Intune Configuration $DisplayName : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
@@ -165,13 +283,16 @@ function New-CIPPRestoreTask {
         }
 
         'intuneprotection' {
-            $BackupConfig = $BackupData.intuneprotection | ConvertFrom-Json
+            $BackupConfig = if ($BackupData.intuneprotection -is [string]) { $BackupData.intuneprotection | ConvertFrom-Json } else { $BackupData.intuneprotection }
             foreach ($backup in $backupConfig) {
                 try {
-                    Set-CIPPIntunePolicy -TemplateType $backup.Type -TenantFilter $TenantFilter -DisplayName $backup.DisplayName -Description $backup.Description -RawJSON ($backup.TemplateJson) -Headers $Headers -APINAME $APINAME -ErrorAction SilentlyContinue
+                    $null = Set-CIPPIntunePolicy -TemplateType $backup.Type -TenantFilter $TenantFilter -DisplayName $backup.DisplayName -Description $backup.Description -RawJSON ($backup.TemplateJson) -Headers $Headers -APINAME $APINAME -ErrorAction SilentlyContinue
+                    $restorationStats['IntuneProtection'].success++
+                    $RestoreData.Add('Restored Intune protection policy from backup')
                 } catch {
+                    $restorationStats['IntuneProtection'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Intune Protection $DisplayName : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Intune Protection $DisplayName : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Intune Configuration $DisplayName : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
@@ -180,14 +301,15 @@ function New-CIPPRestoreTask {
 
         'antispam' {
             try {
-                $BackupConfig = $BackupData.antispam | ConvertFrom-Json | ConvertFrom-Json
+                $BackupConfig = if ($BackupData.antispam -is [string]) { $BackupData.antispam | ConvertFrom-Json } else { $BackupData.antispam }
+                if ($BackupConfig -is [string]) { $BackupConfig = $BackupConfig | ConvertFrom-Json }
                 $BackupPolicies = $BackupConfig.policies
                 $BackupRules = $BackupConfig.rules
                 $CurrentPolicies = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-HostedContentFilterPolicy' | Select-Object * -ExcludeProperty *odata*, *data.type*
                 $CurrentRules = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-HostedContentFilterRule' | Select-Object * -ExcludeProperty *odata*, *data.type*
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
-                "Could not obtain Anti-Spam Configuration: $($ErrorMessage.NormalizedError) "
+                $RestoreData.Add("Could not obtain Anti-Spam Configuration: $($ErrorMessage.NormalizedError) ")
                 Write-LogMessage -Headers $Headers -API $APINAME -message "Could not obtain Anti-Spam Configuration: $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
             }
 
@@ -280,10 +402,11 @@ function New-CIPPRestoreTask {
                                 }
                             }
 
-                            New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-HostedContentFilterPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
+                            $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-HostedContentFilterPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
 
                             Write-LogMessage -message "Restored $($policy.Identity) from backup" -Sev 'info'
-                            "Restored $($policy.Identity) from backup."
+                            $restorationStats['AntiSpam'].success++
+                            $RestoreData.Add("Restored $($policy.Identity) from backup.")
                         }
                     } else {
                         $cmdparams = @{
@@ -300,14 +423,16 @@ function New-CIPPRestoreTask {
                             }
                         }
 
-                        New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-HostedContentFilterPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
+                        $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-HostedContentFilterPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
 
                         Write-LogMessage -message "Restored $($policy.Identity) from backup" -Sev 'info'
-                        "Restored $($policy.Identity) from backup."
+                        $restorationStats['AntiSpam'].success++
+                        $RestoreData.Add("Restored $($policy.Identity) from backup.")
                     }
                 } catch {
+                    $restorationStats['AntiSpam'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Anti-spam policy $($policy.Identity) : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Anti-spam policy $($policy.Identity) : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Anti-spam policy $($policy.Identity) : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
@@ -330,10 +455,11 @@ function New-CIPPRestoreTask {
                                 }
                             }
 
-                            New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-HostedContentFilterRule' -cmdparams $cmdparams -UseSystemMailbox $true
+                            $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-HostedContentFilterRule' -cmdparams $cmdparams -UseSystemMailbox $true
 
                             Write-LogMessage -message "Restored $($rule.Identity) from backup" -Sev 'info'
-                            "Restored $($rule.Identity) from backup."
+                            $restorationStats['AntiSpam'].success++
+                            $RestoreData.Add("Restored $($rule.Identity) from backup.")
                         }
                     } else {
                         $cmdparams = @{
@@ -350,14 +476,16 @@ function New-CIPPRestoreTask {
                             }
                         }
 
-                        New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-HostedContentFilterRule' -cmdparams $cmdparams -UseSystemMailbox $true
+                        $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-HostedContentFilterRule' -cmdparams $cmdparams -UseSystemMailbox $true
 
                         Write-LogMessage -message "Restored $($rule.Identity) from backup" -Sev 'info'
-                        "Restored $($rule.Identity) from backup."
+                        $restorationStats['AntiSpam'].success++
+                        $RestoreData.Add("Restored $($rule.Identity) from backup.")
                     }
                 } catch {
+                    $restorationStats['AntiSpam'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Anti-spam rule $($rule.Identity) : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Anti-spam rule $($rule.Identity) : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Anti-spam rule $($rule.Identity) : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
@@ -365,14 +493,15 @@ function New-CIPPRestoreTask {
 
         'antiphishing' {
             try {
-                $BackupConfig = $BackupData.antiphishing | ConvertFrom-Json | ConvertFrom-Json
+                $BackupConfig = if ($BackupData.antiphishing -is [string]) { $BackupData.antiphishing | ConvertFrom-Json } else { $BackupData.antiphishing }
+                if ($BackupConfig -is [string]) { $BackupConfig = $BackupConfig | ConvertFrom-Json }
                 $BackupPolicies = $BackupConfig.policies
                 $BackupRules = $BackupConfig.rules
                 $CurrentPolicies = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-AntiPhishPolicy' | Select-Object * -ExcludeProperty *odata*, *data.type*
                 $CurrentRules = New-ExoRequest -tenantid $Tenantfilter -cmdlet 'Get-AntiPhishRule' | Select-Object * -ExcludeProperty *odata*, *data.type*
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
-                "Could not obtain Anti-Phishing Configuration: $($ErrorMessage.NormalizedError) "
+                $RestoreData.Add("Could not obtain Anti-Phishing Configuration: $($ErrorMessage.NormalizedError) ")
                 Write-LogMessage -Headers $Headers -API $APINAME -message "Could not obtain Anti-Phishing Configuration: $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
             }
 
@@ -441,10 +570,11 @@ function New-CIPPRestoreTask {
                                 }
                             }
 
-                            New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-AntiPhishPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
+                            $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-AntiPhishPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
 
                             Write-LogMessage -message "Restored $($policy.Identity) from backup" -Sev 'info'
-                            "Restored $($policy.Identity) from backup."
+                            $restorationStats['AntiPhishing'].success++
+                            $RestoreData.Add("Restored $($policy.Identity) from backup.")
                         }
                     } else {
                         $cmdparams = @{
@@ -457,14 +587,16 @@ function New-CIPPRestoreTask {
                             }
                         }
 
-                        New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-AntiPhishPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
+                        $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-AntiPhishPolicy' -cmdparams $cmdparams -UseSystemMailbox $true
 
                         Write-LogMessage -message "Restored $($policy.Identity) from backup" -Sev 'info'
-                        "Restored $($policy.Identity) from backup."
+                        $restorationStats['AntiPhishing'].success++
+                        $RestoreData.Add("Restored $($policy.Identity) from backup.")
                     }
                 } catch {
+                    $restorationStats['AntiPhishing'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Anti-phishing policy $($policy.Identity) : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Anti-phishing policy $($policy.Identity) : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Anti-phishing policy $($policy.Identity) : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
@@ -487,10 +619,11 @@ function New-CIPPRestoreTask {
                                 }
                             }
 
-                            New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-AntiPhishRule' -cmdparams $cmdparams -UseSystemMailbox $true
+                            $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'Set-AntiPhishRule' -cmdparams $cmdparams -UseSystemMailbox $true
 
                             Write-LogMessage -message "Restored $($rule.Identity) from backup" -Sev 'info'
-                            "Restored $($rule.Identity) from backup."
+                            $restorationStats['AntiPhishing'].success++
+                            $RestoreData.Add("Restored $($rule.Identity) from backup.")
                         }
                     } else {
                         $cmdparams = @{
@@ -507,14 +640,16 @@ function New-CIPPRestoreTask {
                             }
                         }
 
-                        New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-AntiPhishRule' -cmdparams $cmdparams -UseSystemMailbox $true
+                        $null = New-ExoRequest -TenantId $Tenantfilter -cmdlet 'New-AntiPhishRule' -cmdparams $cmdparams -UseSystemMailbox $true
 
                         Write-LogMessage -message "Restored $($rule.Identity) from backup" -Sev 'info'
-                        "Restored $($rule.Identity) from backup."
+                        $restorationStats['AntiPhishing'].success++
+                        $RestoreData.Add("Restored $($rule.Identity) from backup.")
                     }
                 } catch {
+                    $restorationStats['AntiPhishing'].failed++
                     $ErrorMessage = Get-CippException -Exception $_
-                    "Could not restore Anti-phishing rule $($rule.Identity) : $($ErrorMessage.NormalizedError) "
+                    $RestoreData.Add("Could not restore Anti-phishing rule $($rule.Identity) : $($ErrorMessage.NormalizedError) ")
                     Write-LogMessage -Headers $Headers -API $APINAME -message "Could not restore Anti-phishing rule $($rule.Identity) : $($ErrorMessage.NormalizedError) " -Sev 'Error' -LogData $ErrorMessage
                 }
             }
@@ -522,26 +657,57 @@ function New-CIPPRestoreTask {
         'CippWebhookAlerts' {
             Write-Host "Restore Webhook Alerts for $TenantFilter"
             $WebhookTable = Get-CIPPTable -TableName 'WebhookRules'
-            $Backup = $BackupData.CippWebhookAlerts | ConvertFrom-Json
+            $Backup = if ($BackupData.CippWebhookAlerts -is [string]) { $BackupData.CippWebhookAlerts | ConvertFrom-Json } else { $BackupData.CippWebhookAlerts }
             try {
                 Add-CIPPAzDataTableEntity @WebhookTable -Entity $Backup -Force
+                $restorationStats['WebhookAlerts'].success++
+                $RestoreData.Add('Restored Webhook Alerts from backup')
             } catch {
+                $restorationStats['WebhookAlerts'].failed++
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-                "Could not restore Webhook Alerts $ErrorMessage"
+                $RestoreData.Add("Could not restore Webhook Alerts $ErrorMessage")
             }
         }
         'CippScriptedAlerts' {
             Write-Host "Restore Scripted Alerts for $TenantFilter"
             $ScheduledTasks = Get-CIPPTable -TableName 'ScheduledTasks'
-            $Backup = $BackupData.CippScriptedAlerts | ConvertFrom-Json
+            $Backup = if ($BackupData.CippScriptedAlerts -is [string]) { $BackupData.CippScriptedAlerts | ConvertFrom-Json } else { $BackupData.CippScriptedAlerts }
             try {
                 Add-CIPPAzDataTableEntity @ScheduledTasks -Entity $Backup -Force
+                $restorationStats['ScriptedAlerts'].success++
+                $RestoreData.Add('Restored Scripted Alerts from backup')
             } catch {
+                $restorationStats['ScriptedAlerts'].failed++
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-                "Could not restore Scripted Alerts $ErrorMessage "
+                $RestoreData.Add("Could not restore Scripted Alerts $ErrorMessage ")
             }
         }
     }
+
+    # Build summary message
+    $summaryParts = @()
+    $successCount = 0
+    $failureCount = 0
+
+    foreach ($type in $restorationStats.Keys) {
+        $successCount += $restorationStats[$type].success
+        $failureCount += $restorationStats[$type].failed
+
+        if ($restorationStats[$type].success -gt 0) {
+            $pluralForm = if ($restorationStats[$type].success -eq 1) { $type.TrimEnd('s') } else { $type }
+            $summaryParts += "$($restorationStats[$type].success) $pluralForm"
+        }
+    }
+
+    if ($summaryParts.Count -gt 0) {
+        $summary = 'Restored: ' + ($summaryParts -join ', ') + ' from backup'
+        if ($failureCount -gt 0) {
+            $summary += " ($failureCount items failed)"
+        }
+        $RestoreData.Add($summary)
+    } elseif ($failureCount -eq 0 -and $successCount -eq 0) {
+        $RestoreData.Add('No items were restored from backup.')
+    }
+
     return $RestoreData
 }
-
diff --git a/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1 b/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1
index a7f2176ab723..76ff020eb9ef 100644
--- a/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1
@@ -52,12 +52,12 @@ function New-CIPPTemplateRun {
                 $ExistingTemplate = $ExistingTemplates | Where-Object { (![string]::IsNullOrEmpty($_.displayName) -and (Get-SanitizedFilename -filename $_.displayName) -eq (Get-SanitizedFilename -filename $File.name)) -or (![string]::IsNullOrEmpty($_.templateName) -and (Get-SanitizedFilename -filename $_.templateName) -eq (Get-SanitizedFilename -filename $File.name) ) -and ![string]::IsNullOrEmpty($_.SHA) } | Select-Object -First 1
 
                 $UpdateNeeded = $false
-                if ($ExistingTemplate -and $ExistingTemplate.SHA -ne $File.sha) {
+                if ($ExistingTemplate -and $ExistingTemplate.SHA -ne $File.sha -and $ExistingTemplate.Source -eq $TemplateSettings.templateRepo.value) {
                     $Name = $ExistingTemplate.displayName ?? $ExistingTemplate.templateName
                     Write-Information "Existing template $($Name) found, but SHA is different. Updating template."
                     $UpdateNeeded = $true
                     "Template $($Name) needs to be updated as the SHA is different"
-                } elseif ($ExistingTemplate -and $ExistingTemplate.SHA -eq $File.sha) {
+                } elseif ($ExistingTemplate -and $ExistingTemplate.SHA -eq $File.sha -and $ExistingTemplate.Source -eq $TemplateSettings.templateRepo.value) {
                     Write-Information "Existing template $($File.name) found, but SHA is the same. No update needed."
                     "Template $($File.name) found, but SHA is the same. No update needed."
                 }
@@ -263,7 +263,7 @@ function New-CIPPTemplateRun {
                                 RAWJson     = $Template.TemplateJson
                                 Type        = $Template.Type
                                 GUID        = $ExistingPolicy.GUID
-                            } | ConvertTo-Json
+                            } | ConvertTo-Json -Compress
 
                             Add-CIPPAzDataTableEntity @Table -Entity @{
                                 JSON         = "$object"
@@ -283,7 +283,7 @@ function New-CIPPTemplateRun {
                                 RAWJson     = $Template.TemplateJson
                                 Type        = $Template.Type
                                 GUID        = $GUID
-                            } | ConvertTo-Json
+                            } | ConvertTo-Json -Compress
 
                             Add-CIPPAzDataTableEntity @Table -Entity @{
                                 JSON         = "$object"
@@ -317,7 +317,7 @@ function New-CIPPTemplateRun {
                                 RAWJson     = $Template.TemplateJson
                                 Type        = $Template.Type
                                 GUID        = $ExistingPolicy.GUID
-                            } | ConvertTo-Json
+                            } | ConvertTo-Json -Compress
 
                             Add-CIPPAzDataTableEntity @Table -Entity @{
                                 JSON         = "$object"
@@ -337,7 +337,7 @@ function New-CIPPTemplateRun {
                                 RAWJson     = $Template.TemplateJson
                                 Type        = $Template.Type
                                 GUID        = $GUID
-                            } | ConvertTo-Json
+                            } | ConvertTo-Json -Compress
 
                             Add-CIPPAzDataTableEntity @Table -Entity @{
                                 JSON         = "$object"
diff --git a/Modules/CIPPCore/Public/New-CIPPUserTask.ps1 b/Modules/CIPPCore/Public/New-CIPPUserTask.ps1
index ed21070cefa5..fb831949ccaa 100644
--- a/Modules/CIPPCore/Public/New-CIPPUserTask.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPUserTask.ps1
@@ -14,15 +14,15 @@ function New-CIPPUserTask {
         $Results.Add("Username: $($CreationResults.Username)")
         $Results.Add("Password: $($CreationResults.Password)")
     } catch {
-        $Results.Add("Failed to create user. $($_.Exception.Message)" )
-        return @{'Results' = $Results }
+        $Results.Add("$($_.Exception.Message)" )
+        throw @{'Results' = $Results }
     }
 
     try {
         if ($UserObj.licenses.value) {
             if ($UserObj.sherwebLicense.value) {
-                $License = Set-SherwebSubscription -Headers $Headers -TenantFilter $UserObj.tenantFilter -SKU $UserObj.sherwebLicense.value -Add 1
-                $null = $results.Add('Added Sherweb License, scheduling assignment')
+                $null = Set-SherwebSubscription -Headers $Headers -TenantFilter $UserObj.tenantFilter -SKU $UserObj.sherwebLicense.value -Add 1
+                $null = $Results.Add('Added Sherweb License, scheduling assignment')
                 $taskObject = [PSCustomObject]@{
                     TenantFilter  = $UserObj.tenantFilter
                     Name          = "Assign License: $UserPrincipalName"
diff --git a/Modules/CIPPCore/Public/Remove-CIPPTrustedBlockedSender.ps1 b/Modules/CIPPCore/Public/Remove-CIPPTrustedBlockedSender.ps1
new file mode 100644
index 000000000000..64b5649b81a1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Remove-CIPPTrustedBlockedSender.ps1
@@ -0,0 +1,30 @@
+function Remove-CIPPTrustedBlockedSender {
+    [CmdletBinding()]
+    param (
+        [string]$UserPrincipalName,
+        [string]$TenantFilter,
+        [string]$APIName = 'Trusted/Blocked Sender Removal',
+        $Headers,
+        [string]$TypeProperty,
+        [string]$Value
+    )
+
+    try {
+
+        # Set the updated configuration
+        $SetParams = @{
+            Identity      = $UserPrincipalName
+            $TypeProperty = @{'@odata.type' = '#Exchange.GenericHashTable'; Remove = $Value }
+        }
+
+        $null = New-ExoRequest -Anchor $UserPrincipalName -tenantid $TenantFilter -cmdlet 'Set-MailboxJunkEmailConfiguration' -cmdParams $SetParams
+        $Message = "Successfully removed '$Value' from $TypeProperty for $($UserPrincipalName)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Message -Sev 'Info' -tenant $TenantFilter
+        return $Message
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Message = "Failed to remove junk email configuration entry for $($UserPrincipalName). Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Message -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage
+        throw $Message
+    }
+}
diff --git a/Modules/CIPPCore/Public/Search-CIPPDbData.ps1 b/Modules/CIPPCore/Public/Search-CIPPDbData.ps1
new file mode 100644
index 000000000000..1ef40a996260
--- /dev/null
+++ b/Modules/CIPPCore/Public/Search-CIPPDbData.ps1
@@ -0,0 +1,174 @@
+function Search-CIPPDbData {
+    <#
+    .SYNOPSIS
+        Universal search function for CIPP Reporting DB data
+
+    .DESCRIPTION
+        Searches JSON objects in the CIPP Reporting DB for matching search terms.
+        Supports wildcard and regular expression searches across multiple data types.
+        Returns results as a flat list with Type property included.
+
+    .PARAMETER TenantFilter
+        Optional tenant domain or GUID to filter search. If not specified, searches all tenants.
+
+    .PARAMETER SearchTerms
+        Search terms to look for. Uses regex matching by default (special characters are escaped).
+        Can be a single string or array of strings.
+
+    .PARAMETER Types
+        Array of data types to search. If not specified, searches all available types.
+        Valid types: Users, Domains, ConditionalAccessPolicies, ManagedDevices, Organization,
+        Groups, Roles, LicenseOverview, IntuneDeviceCompliancePolicies, SecureScore,
+        SecureScoreControlProfiles, Mailboxes, CASMailbox, MailboxPermissions, OneDriveUsage, MailboxUsage
+
+    .PARAMETER MatchAll
+        If specified, all search terms must be found. Default is false (any term matches).
+
+    .PARAMETER MaxResultsPerType
+        Maximum number of results to return per type. Default is unlimited (0)
+
+    .EXAMPLE
+        Search-CIPPDbData -TenantFilter 'contoso.onmicrosoft.com' -SearchTerms 'john.doe' -Types 'Users', 'Groups'
+
+    .EXAMPLE
+        Search-CIPPDbData -SearchTerms 'admin' -Types 'Users'
+
+    .EXAMPLE
+        Search-CIPPDbData -SearchTerms 'SecurityDefaults', 'ConditionalAccess' -Types 'ConditionalAccessPolicies', 'Organization'
+
+    .EXAMPLE
+        Search-CIPPDbData -SearchTerms 'SecurityDefaults', 'ConditionalAccess' -Types 'ConditionalAccessPolicies', 'Organization'
+
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $true)]
+        [string[]]$SearchTerms,
+
+        [Parameter(Mandatory = $false)]
+        [ValidateSet(
+            'Users', 'Domains', 'ConditionalAccessPolicies', 'ManagedDevices', 'Organization',
+            'Groups', 'Roles', 'LicenseOverview', 'IntuneDeviceCompliancePolicies', 'SecureScore',
+            'SecureScoreControlProfiles', 'Mailboxes', 'CASMailbox', 'MailboxPermissions',
+            'OneDriveUsage', 'MailboxUsage', 'Devices', 'AllRoles', 'Licenses', 'DeviceCompliancePolicies'
+        )]
+        [string[]]$Types,
+
+        [Parameter(Mandatory = $false)]
+        [switch]$MatchAll,
+
+        [Parameter(Mandatory = $false)]
+        [int]$MaxResultsPerType = 0
+    )
+
+    try {
+        # Initialize results list
+        $Results = [System.Collections.Generic.List[object]]::new()
+
+        # Define all available types if not specified
+        if (-not $Types) {
+            $Types = @(
+                'Users', 'Domains', 'ConditionalAccessPolicies', 'ManagedDevices', 'Organization',
+                'Groups', 'Roles', 'LicenseOverview', 'IntuneDeviceCompliancePolicies', 'SecureScore',
+                'SecureScoreControlProfiles', 'Mailboxes', 'CASMailbox', 'MailboxPermissions',
+                'OneDriveUsage', 'MailboxUsage'
+            )
+        }
+
+        # Get tenants to search - use 'allTenants' if no filter specified
+        $TenantsToSearch = @()
+        if ($TenantFilter) {
+            $TenantsToSearch = @($TenantFilter)
+        } else {
+            # Use 'allTenants' to search across all tenants
+            $TenantsToSearch = @('allTenants')
+            Write-Verbose 'Searching all tenants'
+        }
+
+        # Process each data type
+        foreach ($Type in $Types) {
+            Write-Verbose "Searching type: $Type"
+            $TypeResults = [System.Collections.Generic.List[object]]::new()
+
+            # Search across all tenants
+            foreach ($Tenant in $TenantsToSearch) {
+                if (-not $Tenant) { continue }
+
+                try {
+                    # Get items for this type and tenant
+                    $Items = Get-CIPPDbItem -TenantFilter $Tenant -Type $Type | Where-Object { $_.RowKey -notlike '*-Count' }
+                    Write-Verbose "Found $(@($Items).Count) items for type '$Type' in tenant '$Tenant'"
+
+                    if ($Items) {
+                        foreach ($Item in $Items) {
+                            # Data is already in JSON format, do a quick text search first
+                            if (-not $Item.Data) { continue }
+
+                            # Check if any search term matches in the JSON string
+                            $IsMatch = $false
+
+                            if ($MatchAll) {
+                                # All terms must match
+                                $IsMatch = $true
+                                foreach ($SearchTerm in $SearchTerms) {
+                                    $SearchPattern = [regex]::Escape($SearchTerm)
+                                    if ($Item.Data -notmatch $SearchPattern) {
+                                        $IsMatch = $false
+                                        break
+                                    }
+                                }
+                            } else {
+                                # Any term can match (default)
+                                foreach ($SearchTerm in $SearchTerms) {
+                                    $SearchPattern = [regex]::Escape($SearchTerm)
+                                    if ($Item.Data -match $SearchPattern) {
+                                        $IsMatch = $true
+                                        break
+                                    }
+                                }
+                            }
+
+                            # Only parse JSON if we have a match
+                            if ($IsMatch) {
+                                try {
+                                    $Data = $Item.Data | ConvertFrom-Json
+                                    $ResultItem = [PSCustomObject]@{
+                                        Tenant    = $Item.PartitionKey
+                                        Type      = $Type
+                                        RowKey    = $Item.RowKey
+                                        Data      = $Data
+                                        Timestamp = $Item.Timestamp
+                                    }
+                                    $Results.Add($ResultItem)
+
+                                    # Check max results per type
+                                    if ($MaxResultsPerType -gt 0 -and $Results.Count -ge $MaxResultsPerType) {
+                                        break
+                                    }
+                                } catch {
+                                    Write-Verbose "Failed to parse JSON for $($Item.RowKey): $($_.Exception.Message)"
+                                }
+                            }
+                        }
+                    }
+
+                } catch {
+                    Write-Verbose "Error searching type '$Type' for tenant '$Tenant': $($_.Exception.Message)"
+                }
+            }
+        }
+
+        Write-Verbose "Found $($Results.Count) total results"
+        # Return results as flat list
+        return $Results.ToArray()
+
+    } catch {
+        Write-LogMessage -API 'UniversalSearch' -tenant $TenantFilter -message "Failed to perform universal search: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1 b/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1
index 17b9201199e3..771c6f4fc6fe 100644
--- a/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1
@@ -88,11 +88,11 @@ function Set-CIPPAssignedApplication {
                     $resolvedGroupIds = $GroupIds
                 } else {
                     $GroupNames = $GroupName.Split(',')
-                    $resolvedGroupIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups' -tenantid $TenantFilter | ForEach-Object {
+                    $resolvedGroupIds = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999&$select=id,displayName' -tenantid $TenantFilter | ForEach-Object {
                         $Group = $_
                         foreach ($SingleName in $GroupNames) {
-                            if ($_.displayName -like $SingleName) {
-                                $group.id
+                            if ($Group.displayName -like $SingleName) {
+                                $Group.id
                             }
                         }
                     }
@@ -177,7 +177,6 @@ function Set-CIPPAssignedApplication {
         }
         if ($PSCmdlet.ShouldProcess($GroupName, "Assigning Application $ApplicationId")) {
             Start-Sleep -Seconds 1
-            # Write-Information (ConvertTo-Json $DefaultAssignmentObject -Depth 10)
             $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps/$($ApplicationId)/assign" -tenantid $TenantFilter -type POST -body ($DefaultAssignmentObject | ConvertTo-Json -Compress -Depth 10)
             Write-LogMessage -headers $Headers -API $APIName -message "Assigned Application $ApplicationId to $($GroupName)" -Sev 'Info' -tenant $TenantFilter
         }
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheAdminConsentRequestPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheAdminConsentRequestPolicy.ps1
new file mode 100644
index 000000000000..945d69f854cd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheAdminConsentRequestPolicy.ps1
@@ -0,0 +1,27 @@
+function Set-CIPPDBCacheAdminConsentRequestPolicy {
+    <#
+    .SYNOPSIS
+        Caches admin consent request policy and settings for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache consent policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching admin consent request policy' -sev Debug
+        $ConsentPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/adminConsentRequestPolicy' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AdminConsentRequestPolicy' -Data @($ConsentPolicy)
+        $ConsentPolicy = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached admin consent request policy successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache admin consent request policy: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheAppRoleAssignments.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheAppRoleAssignments.ps1
new file mode 100644
index 000000000000..3ba077a2cdeb
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheAppRoleAssignments.ps1
@@ -0,0 +1,47 @@
+function Set-CIPPDBCacheAppRoleAssignments {
+    <#
+    .SYNOPSIS
+        Caches application role assignments for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache app role assignments for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching app role assignments' -sev Debug
+
+        # Get all service principals first
+        $ServicePrincipals = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals?$select=id,appId,displayName&$top=999&expand=appRoleAssignments' -tenantid $TenantFilter
+
+        $AllAppRoleAssignments = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($SP in $ServicePrincipals) {
+            try {
+                $AppRoleAssignments = $SP.appRoleAssignments
+                foreach ($Assignment in $AppRoleAssignments) {
+                    # Enrich with service principal info
+                    $Assignment | Add-Member -NotePropertyName 'servicePrincipalDisplayName' -NotePropertyValue $SP.displayName -Force
+                    $Assignment | Add-Member -NotePropertyName 'servicePrincipalAppId' -NotePropertyValue $SP.appId -Force
+                    $AllAppRoleAssignments.Add($Assignment)
+                }
+            } catch {
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to get app role assignments for $($SP.displayName): $($_.Exception.Message)" -sev Warning
+            }
+        }
+
+        if ($AllAppRoleAssignments.Count -gt 0) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AppRoleAssignments' -Data $AllAppRoleAssignments
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AppRoleAssignments' -Data $AllAppRoleAssignments -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AllAppRoleAssignments.Count) app role assignments" -sev Debug
+        }
+        $AllAppRoleAssignments = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache app role assignments: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheApps.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheApps.ps1
new file mode 100644
index 000000000000..22200d76dbf3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheApps.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheApps {
+    <#
+    .SYNOPSIS
+        Caches all application registrations for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache applications for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching applications' -sev Debug
+
+        $Apps = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/applications?$top=999&expand=owners' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Apps' -Data $Apps
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Apps' -Data $Apps -Count
+        $Apps = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached applications successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache applications: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationFlowsPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationFlowsPolicy.ps1
new file mode 100644
index 000000000000..7b75a2b23eaa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationFlowsPolicy.ps1
@@ -0,0 +1,31 @@
+function Set-CIPPDBCacheAuthenticationFlowsPolicy {
+    <#
+    .SYNOPSIS
+        Caches authentication flows policy for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache authentication flows policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching authentication flows policy' -sev Debug
+
+        $AuthFlowPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authenticationFlowsPolicy' -tenantid $TenantFilter -AsApp $true
+
+        if ($AuthFlowPolicy) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationFlowsPolicy' -Data @($AuthFlowPolicy)
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached authentication flows policy successfully' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache authentication flows policy: $($_.Exception.Message)" `
+            -sev Warning `
+            -LogData (Get-CippException -Exception $_)
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationMethodsPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationMethodsPolicy.ps1
new file mode 100644
index 000000000000..98ea20dd05d7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthenticationMethodsPolicy.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheAuthenticationMethodsPolicy {
+    <#
+    .SYNOPSIS
+        Caches authentication methods policy for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache authentication methods policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching authentication methods policy' -sev Debug
+        $AuthMethodsPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationMethodsPolicy' -Data @($AuthMethodsPolicy)
+        $AuthMethodsPolicy = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached authentication methods policy successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache authentication methods policy: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthorizationPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthorizationPolicy.ps1
new file mode 100644
index 000000000000..ca6c92bfe624
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheAuthorizationPolicy.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheAuthorizationPolicy {
+    <#
+    .SYNOPSIS
+        Caches authorization policy for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache authorization policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching authorization policy' -sev Debug
+        $AuthPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthorizationPolicy' -Data @($AuthPolicy)
+        $AuthPolicy = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached authorization policy successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache authorization policy: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheB2BManagementPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheB2BManagementPolicy.ps1
new file mode 100644
index 000000000000..f00d7d4c8fc0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheB2BManagementPolicy.ps1
@@ -0,0 +1,31 @@
+function Set-CIPPDBCacheB2BManagementPolicy {
+    <#
+    .SYNOPSIS
+        Caches B2B management policy for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache B2B management policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching B2B management policy' -sev Debug
+
+        $LegacyPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/b2bManagementPolicies' -tenantid $TenantFilter
+        $B2BManagementPolicy = $LegacyPolicies
+
+        if ($B2BManagementPolicy) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'B2BManagementPolicy' -Data @($B2BManagementPolicy)
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached B2B management policy successfully' -sev Debug
+        } else {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No B2B management policy found' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache B2B management policy: $($_.Exception.Message)" -sev Warning -LogData (Get-CippException -Exception $_)
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheConditionalAccessPolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheConditionalAccessPolicies.ps1
new file mode 100644
index 000000000000..729644ed5d40
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheConditionalAccessPolicies.ps1
@@ -0,0 +1,68 @@
+function Set-CIPPDBCacheConditionalAccessPolicies {
+    <#
+    .SYNOPSIS
+        Caches all Conditional Access policies, named locations, and authentication strengths for a tenant (if CA capable)
+
+    .PARAMETER TenantFilter
+        The tenant to cache CA policies for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        $TestResult = Test-CIPPStandardLicense -StandardName 'ConditionalAccessCache' -TenantFilter $TenantFilter -RequiredCapabilities @('AAD_PREMIUM', 'AAD_PREMIUM_P2') -SkipLog
+
+        if ($TestResult -eq $false) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Tenant does not have Azure AD Premium license, skipping CA' -sev Debug
+            return
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Conditional Access policies' -sev Debug
+
+        try {
+            $CAPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/policies?$top=999' -tenantid $TenantFilter
+            if ($CAPolicies) {
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies' -Data $CAPolicies
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies' -Data $CAPolicies -Count
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($CAPolicies.Count) CA policies" -sev Debug
+            }
+            $CAPolicies = $null
+        } catch {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache CA policies: $($_.Exception.Message)" -sev Warning
+        }
+
+        try {
+            $NamedLocations = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations?$top=999' -tenantid $TenantFilter
+
+            if ($NamedLocations) {
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'NamedLocations' -Data $NamedLocations
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'NamedLocations' -Data $NamedLocations -Count
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($NamedLocations.Count) named locations" -sev Debug
+            }
+            $NamedLocations = $null
+        } catch {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache named locations: $($_.Exception.Message)" -sev Warning
+        }
+
+        try {
+            $AuthStrengths = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/authenticationStrength/policies' -tenantid $TenantFilter
+
+            if ($AuthStrengths) {
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationStrengths' -Data $AuthStrengths
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'AuthenticationStrengths' -Data $AuthStrengths -Count
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AuthStrengths.Count) authentication strengths" -sev Debug
+            }
+            $AuthStrengths = $null
+        } catch {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache authentication strengths: $($_.Exception.Message)" -sev Warning
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached CA data successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Conditional Access data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheCredentialUserRegistrationDetails.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheCredentialUserRegistrationDetails.ps1
new file mode 100644
index 000000000000..888c398ffea3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheCredentialUserRegistrationDetails.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheCredentialUserRegistrationDetails {
+    <#
+    .SYNOPSIS
+        Caches MFA and SSPR registration details for all users in a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache credential user registration details for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching credential user registration details' -sev Debug
+
+        $CredentialUserRegistrationDetails = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/reports/credentialUserRegistrationDetails' -tenantid $TenantFilter
+
+        if ($CredentialUserRegistrationDetails) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CredentialUserRegistrationDetails' -Data $CredentialUserRegistrationDetails
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CredentialUserRegistrationDetails' -Data $CredentialUserRegistrationDetails -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($CredentialUserRegistrationDetails.Count) credential user registration details" -sev Debug
+        }
+        $CredentialUserRegistrationDetails = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache credential user registration details: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheCrossTenantAccessPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheCrossTenantAccessPolicy.ps1
new file mode 100644
index 000000000000..cc4203420b96
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheCrossTenantAccessPolicy.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheCrossTenantAccessPolicy {
+    <#
+    .SYNOPSIS
+        Caches cross-tenant access policy for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching cross-tenant access policy' -sev Debug
+        $CrossTenantPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/crossTenantAccessPolicy/default' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CrossTenantAccessPolicy' -Data @($CrossTenantPolicy)
+        $CrossTenantPolicy = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached cross-tenant access policy successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache cross-tenant access policy: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheDefaultAppManagementPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheDefaultAppManagementPolicy.ps1
new file mode 100644
index 000000000000..c053f36435a4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheDefaultAppManagementPolicy.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheDefaultAppManagementPolicy {
+    <#
+    .SYNOPSIS
+        Caches default app management policy for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching default app management policy' -sev Debug
+        $AppMgmtPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/defaultAppManagementPolicy' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'DefaultAppManagementPolicy' -Data @($AppMgmtPolicy)
+        $AppMgmtPolicy = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached default app management policy successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache default app management policy: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceRegistrationPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceRegistrationPolicy.ps1
new file mode 100644
index 000000000000..3a9eada7c7a6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceRegistrationPolicy.ps1
@@ -0,0 +1,31 @@
+function Set-CIPPDBCacheDeviceRegistrationPolicy {
+    <#
+    .SYNOPSIS
+        Caches device registration policy for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache device registration policy for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching device registration policy' -sev Debug
+
+        $DeviceRegistrationPolicy = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy' -tenantid $TenantFilter
+
+        if ($DeviceRegistrationPolicy) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'DeviceRegistrationPolicy' -Data @($DeviceRegistrationPolicy)
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached device registration policy successfully' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache device registration policy: $($_.Exception.Message)" `
+            -sev Warning `
+            -LogData (Get-CippException -Exception $_)
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceSettings.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceSettings.ps1
new file mode 100644
index 000000000000..7845f72ffa8a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheDeviceSettings.ps1
@@ -0,0 +1,28 @@
+function Set-CIPPDBCacheDeviceSettings {
+    <#
+    .SYNOPSIS
+        Caches device settings for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache device settings for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching device settings' -sev Debug
+
+        $DeviceSettings = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/directory/deviceLocalCredentials' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'DeviceSettings' -Data @($DeviceSettings)
+        $DeviceSettings = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached device settings successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache device settings: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheDevices.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheDevices.ps1
new file mode 100644
index 000000000000..2953483d47a7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheDevices.ps1
@@ -0,0 +1,28 @@
+function Set-CIPPDBCacheDevices {
+    <#
+    .SYNOPSIS
+        Caches all Azure AD devices for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache devices for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Azure AD devices' -sev Debug
+
+        $Devices = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/devices?$top=999&$select=id,displayName,operatingSystem,operatingSystemVersion,trustType,accountEnabled,approximateLastSignInDateTime' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Devices' -Data $Devices
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Devices' -Data $Devices -Count
+        $Devices = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Azure AD devices successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Azure AD devices: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheDirectoryRecommendations.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheDirectoryRecommendations.ps1
new file mode 100644
index 000000000000..616c7ab82503
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheDirectoryRecommendations.ps1
@@ -0,0 +1,28 @@
+function Set-CIPPDBCacheDirectoryRecommendations {
+    <#
+    .SYNOPSIS
+        Caches directory recommendations for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache recommendations for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching directory recommendations' -sev Debug
+
+        $Recommendations = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/directory/recommendations?$top=999' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'DirectoryRecommendations' -Data $Recommendations
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'DirectoryRecommendations' -Data $Recommendations -Count
+        $Recommendations = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached directory recommendations successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache directory recommendations: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheDomains.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheDomains.ps1
new file mode 100644
index 000000000000..b546382b3103
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheDomains.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheDomains {
+    <#
+    .SYNOPSIS
+        Caches domains for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache domains for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching domains' -sev Debug
+        $Domains = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/domains' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Domains' -Data @($Domains)
+        $Domains = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached domains successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache domains: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAcceptedDomains.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAcceptedDomains.ps1
new file mode 100644
index 000000000000..cbe7bd854481
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAcceptedDomains.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheExoAcceptedDomains {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Accepted Domains
+
+    .PARAMETER TenantFilter
+        The tenant to cache accepted domains for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Accepted Domains' -sev Debug
+
+        $AcceptedDomains = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AcceptedDomain'
+
+        if ($AcceptedDomains) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAcceptedDomains' -Data $AcceptedDomains
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAcceptedDomains' -Data $AcceptedDomains -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AcceptedDomains.Count) Accepted Domains" -sev Debug
+        }
+        $AcceptedDomains = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Accepted Domains: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAdminAuditLogConfig.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAdminAuditLogConfig.ps1
new file mode 100644
index 000000000000..892e471647fe
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAdminAuditLogConfig.ps1
@@ -0,0 +1,32 @@
+function Set-CIPPDBCacheExoAdminAuditLogConfig {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Admin Audit Log Configuration
+
+    .PARAMETER TenantFilter
+        The tenant to cache admin audit log config for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Admin Audit Log configuration' -sev Debug
+
+        $AuditConfig = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AdminAuditLogConfig'
+
+        if ($AuditConfig) {
+            # AdminAuditLogConfig returns a single object, wrap in array for consistency
+            $AuditConfigArray = @($AuditConfig)
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAdminAuditLogConfig' -Data $AuditConfigArray
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAdminAuditLogConfig' -Data $AuditConfigArray -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Exchange Admin Audit Log configuration' -sev Debug
+        }
+        $AuditConfig = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Admin Audit Log configuration: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAntiPhishPolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAntiPhishPolicies.ps1
new file mode 100644
index 000000000000..98a525d1f0a0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAntiPhishPolicies.ps1
@@ -0,0 +1,39 @@
+function Set-CIPPDBCacheExoAntiPhishPolicies {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Anti-Phishing policies and rules
+
+    .PARAMETER TenantFilter
+        The tenant to cache Anti-Phishing data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Anti-Phishing policies and rules' -sev Debug
+
+        # Get Anti-Phishing policies
+        $AntiPhishPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AntiPhishPolicy'
+        if ($AntiPhishPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAntiPhishPolicies' -Data $AntiPhishPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAntiPhishPolicies' -Data $AntiPhishPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AntiPhishPolicies.Count) Anti-Phishing policies" -sev Debug
+        }
+        $AntiPhishPolicies = $null
+
+        # Get Anti-Phishing rules
+        $AntiPhishRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AntiPhishRule'
+        if ($AntiPhishRules) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAntiPhishRules' -Data $AntiPhishRules
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAntiPhishRules' -Data $AntiPhishRules -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AntiPhishRules.Count) Anti-Phishing rules" -sev Debug
+        }
+        $AntiPhishRules = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Anti-Phishing data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAntiPhishPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAntiPhishPolicy.ps1
new file mode 100644
index 000000000000..b65b084e9ae1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAntiPhishPolicy.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoAntiPhishPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Anti-Phish policies (detailed)
+
+    .PARAMETER TenantFilter
+        The tenant to cache Anti-Phish policy data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Anti-Phish policies (detailed)' -sev Debug
+
+        $AntiPhishPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AntiPhishPolicy'
+        if ($AntiPhishPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAntiPhishPolicy' -Data $AntiPhishPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAntiPhishPolicy' -Data $AntiPhishPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AntiPhishPolicies.Count) Anti-Phish policies (detailed)" -sev Debug
+        }
+        $AntiPhishPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Anti-Phish policy data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAtpPolicyForO365.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAtpPolicyForO365.ps1
new file mode 100644
index 000000000000..ee0b2203fa0b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoAtpPolicyForO365.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoAtpPolicyForO365 {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online ATP policies for Office 365
+
+    .PARAMETER TenantFilter
+        The tenant to cache ATP policy data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange ATP policies for Office 365' -sev Debug
+
+        $AtpPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AtpPolicyForO365'
+        if ($AtpPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAtpPolicyForO365' -Data $AtpPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoAtpPolicyForO365' -Data $AtpPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AtpPolicies.Count) ATP policies for Office 365" -sev Debug
+        }
+        $AtpPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache ATP policy data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoDkimSigningConfig.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoDkimSigningConfig.ps1
new file mode 100644
index 000000000000..fb72c35dec68
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoDkimSigningConfig.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheExoDkimSigningConfig {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online DKIM signing configuration
+
+    .PARAMETER TenantFilter
+        The tenant to cache DKIM configuration for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange DKIM signing configuration' -sev Debug
+
+        $DkimConfig = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-DkimSigningConfig'
+
+        if ($DkimConfig) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoDkimSigningConfig' -Data $DkimConfig
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoDkimSigningConfig' -Data $DkimConfig -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($DkimConfig.Count) DKIM configurations" -sev Debug
+        }
+        $DkimConfig = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache DKIM configuration: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoHostedContentFilterPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoHostedContentFilterPolicy.ps1
new file mode 100644
index 000000000000..b6bb5fd5c571
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoHostedContentFilterPolicy.ps1
@@ -0,0 +1,28 @@
+function Set-CIPPDBCacheExoHostedContentFilterPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Hosted Content Filter policies
+
+    .PARAMETER TenantFilter
+        The tenant to cache Hosted Content Filter data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Hosted Content Filter policies' -sev Debug
+        $HostedContentFilterPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-HostedContentFilterPolicy'
+        if ($HostedContentFilterPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoHostedContentFilterPolicy' -Data $HostedContentFilterPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoHostedContentFilterPolicy' -Data $HostedContentFilterPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($HostedContentFilterPolicies.Count) Hosted Content Filter policies" -sev Debug
+        }
+        $HostedContentFilterPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Hosted Content Filter data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoHostedOutboundSpamFilterPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoHostedOutboundSpamFilterPolicy.ps1
new file mode 100644
index 000000000000..06201cd38b63
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoHostedOutboundSpamFilterPolicy.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoHostedOutboundSpamFilterPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Hosted Outbound Spam Filter policies
+
+    .PARAMETER TenantFilter
+        The tenant to cache Hosted Outbound Spam Filter data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Hosted Outbound Spam Filter policies' -sev Debug
+
+        $HostedOutboundSpamFilterPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-HostedOutboundSpamFilterPolicy'
+        if ($HostedOutboundSpamFilterPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoHostedOutboundSpamFilterPolicy' -Data $HostedOutboundSpamFilterPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoHostedOutboundSpamFilterPolicy' -Data $HostedOutboundSpamFilterPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($HostedOutboundSpamFilterPolicies.Count) Hosted Outbound Spam Filter policies" -sev Debug
+        }
+        $HostedOutboundSpamFilterPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Hosted Outbound Spam Filter data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoMalwareFilterPolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoMalwareFilterPolicies.ps1
new file mode 100644
index 000000000000..f50d64d610b8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoMalwareFilterPolicies.ps1
@@ -0,0 +1,39 @@
+function Set-CIPPDBCacheExoMalwareFilterPolicies {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Malware Filter policies and rules
+
+    .PARAMETER TenantFilter
+        The tenant to cache Malware Filter data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Malware Filter policies and rules' -sev Debug
+
+        # Get Malware Filter policies
+        $MalwarePolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MalwareFilterPolicy'
+        if ($MalwarePolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoMalwareFilterPolicies' -Data $MalwarePolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoMalwareFilterPolicies' -Data $MalwarePolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($MalwarePolicies.Count) Malware Filter policies" -sev Debug
+        }
+        $MalwarePolicies = $null
+
+        # Get Malware Filter rules
+        $MalwareRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MalwareFilterRule'
+        if ($MalwareRules) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoMalwareFilterRules' -Data $MalwareRules
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoMalwareFilterRules' -Data $MalwareRules -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($MalwareRules.Count) Malware Filter rules" -sev Debug
+        }
+        $MalwareRules = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Malware Filter data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoMalwareFilterPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoMalwareFilterPolicy.ps1
new file mode 100644
index 000000000000..194501e09e9a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoMalwareFilterPolicy.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoMalwareFilterPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Malware Filter policies (detailed)
+
+    .PARAMETER TenantFilter
+        The tenant to cache Malware Filter policy data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Malware Filter policies (detailed)' -sev Debug
+
+        $MalwareFilterPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MalwareFilterPolicy'
+        if ($MalwareFilterPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoMalwareFilterPolicy' -Data $MalwareFilterPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoMalwareFilterPolicy' -Data $MalwareFilterPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($MalwareFilterPolicies.Count) Malware Filter policies (detailed)" -sev Debug
+        }
+        $MalwareFilterPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Malware Filter policy data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoOrganizationConfig.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoOrganizationConfig.ps1
new file mode 100644
index 000000000000..6138bd21a3e3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoOrganizationConfig.ps1
@@ -0,0 +1,32 @@
+function Set-CIPPDBCacheExoOrganizationConfig {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Organization Configuration
+
+    .PARAMETER TenantFilter
+        The tenant to cache organization configuration for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Organization configuration' -sev Debug
+
+        $OrgConfig = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-OrganizationConfig'
+
+        if ($OrgConfig) {
+            # OrganizationConfig returns a single object, wrap in array for consistency
+            $OrgConfigArray = @($OrgConfig)
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoOrganizationConfig' -Data $OrgConfigArray
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoOrganizationConfig' -Data $OrgConfigArray -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Exchange Organization configuration' -sev Debug
+        }
+        $OrgConfig = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Organization configuration: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1
new file mode 100644
index 000000000000..a10092fba9ce
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1
@@ -0,0 +1,42 @@
+function Set-CIPPDBCacheExoPresetSecurityPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Preset Security Policies (EOP and ATP Protection Policy Rules)
+
+    .PARAMETER TenantFilter
+        The tenant to cache preset security policies for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Preset Security Policies' -sev Debug
+
+        $EOPRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-EOPProtectionPolicyRule'
+        $ATPRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-ATPProtectionPolicyRule'
+
+        # Combine both rule types into a single collection
+        $AllRules = @()
+        if ($EOPRules) {
+            $AllRules += $EOPRules
+        }
+        if ($ATPRules) {
+            $AllRules += $ATPRules
+        }
+
+        if ($AllRules.Count -gt 0) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoPresetSecurityPolicy' -Data $AllRules
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoPresetSecurityPolicy' -Data $AllRules -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AllRules.Count) Preset Security Policy rules" -sev Debug
+        }
+        $EOPRules = $null
+        $ATPRules = $null
+        $AllRules = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Preset Security Policies: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoQuarantinePolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoQuarantinePolicy.ps1
new file mode 100644
index 000000000000..2ef8bf63639a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoQuarantinePolicy.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoQuarantinePolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Quarantine policies
+
+    .PARAMETER TenantFilter
+        The tenant to cache Quarantine policy data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Quarantine policies' -sev Debug
+
+        $QuarantinePolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantinePolicy'
+        if ($QuarantinePolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoQuarantinePolicy' -Data $QuarantinePolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoQuarantinePolicy' -Data $QuarantinePolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($QuarantinePolicies.Count) Quarantine policies" -sev Debug
+        }
+        $QuarantinePolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Quarantine policy data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoRemoteDomain.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoRemoteDomain.ps1
new file mode 100644
index 000000000000..692ba803c6de
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoRemoteDomain.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoRemoteDomain {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Remote Domains
+
+    .PARAMETER TenantFilter
+        The tenant to cache Remote Domain data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Remote Domains' -sev Debug
+
+        $RemoteDomains = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-RemoteDomain'
+        if ($RemoteDomains) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoRemoteDomain' -Data $RemoteDomains
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoRemoteDomain' -Data $RemoteDomains -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($RemoteDomains.Count) Remote Domains" -sev Debug
+        }
+        $RemoteDomains = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Remote Domain data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeAttachmentPolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeAttachmentPolicies.ps1
new file mode 100644
index 000000000000..172e86887e66
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeAttachmentPolicies.ps1
@@ -0,0 +1,39 @@
+function Set-CIPPDBCacheExoSafeAttachmentPolicies {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Safe Attachment policies and rules
+
+    .PARAMETER TenantFilter
+        The tenant to cache Safe Attachment data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Safe Attachment policies and rules' -sev Debug
+
+        # Get Safe Attachment policies
+        $SafeAttachmentPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-SafeAttachmentPolicy'
+        if ($SafeAttachmentPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeAttachmentPolicies' -Data $SafeAttachmentPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeAttachmentPolicies' -Data $SafeAttachmentPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($SafeAttachmentPolicies.Count) Safe Attachment policies" -sev Debug
+        }
+        $SafeAttachmentPolicies = $null
+
+        # Get Safe Attachment rules
+        $SafeAttachmentRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-SafeAttachmentRule'
+        if ($SafeAttachmentRules) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeAttachmentRules' -Data $SafeAttachmentRules
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeAttachmentRules' -Data $SafeAttachmentRules -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($SafeAttachmentRules.Count) Safe Attachment rules" -sev Debug
+        }
+        $SafeAttachmentRules = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Safe Attachment data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeAttachmentPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeAttachmentPolicy.ps1
new file mode 100644
index 000000000000..6ebe371e5291
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeAttachmentPolicy.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoSafeAttachmentPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Safe Attachment policies (detailed)
+
+    .PARAMETER TenantFilter
+        The tenant to cache Safe Attachment policy data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Safe Attachment policies (detailed)' -sev Debug
+
+        $SafeAttachmentPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-SafeAttachmentPolicy'
+        if ($SafeAttachmentPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeAttachmentPolicy' -Data $SafeAttachmentPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeAttachmentPolicy' -Data $SafeAttachmentPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($SafeAttachmentPolicies.Count) Safe Attachment policies (detailed)" -sev Debug
+        }
+        $SafeAttachmentPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Safe Attachment policy data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeLinksPolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeLinksPolicies.ps1
new file mode 100644
index 000000000000..c06fb2f08971
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeLinksPolicies.ps1
@@ -0,0 +1,39 @@
+function Set-CIPPDBCacheExoSafeLinksPolicies {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Safe Links policies and rules
+
+    .PARAMETER TenantFilter
+        The tenant to cache Safe Links data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Safe Links policies and rules' -sev Debug
+
+        # Get Safe Links policies
+        $SafeLinksPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-SafeLinksPolicy'
+        if ($SafeLinksPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeLinksPolicies' -Data $SafeLinksPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeLinksPolicies' -Data $SafeLinksPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($SafeLinksPolicies.Count) Safe Links policies" -sev Debug
+        }
+        $SafeLinksPolicies = $null
+
+        # Get Safe Links rules
+        $SafeLinksRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-SafeLinksRule'
+        if ($SafeLinksRules) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeLinksRules' -Data $SafeLinksRules
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeLinksRules' -Data $SafeLinksRules -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($SafeLinksRules.Count) Safe Links rules" -sev Debug
+        }
+        $SafeLinksRules = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Safe Links data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeLinksPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeLinksPolicy.ps1
new file mode 100644
index 000000000000..a3252b245bcd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSafeLinksPolicy.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheExoSafeLinksPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Safe Links policies (detailed)
+
+    .PARAMETER TenantFilter
+        The tenant to cache Safe Links policy data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Safe Links policies (detailed)' -sev Debug
+
+        $SafeLinksPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-SafeLinksPolicy'
+        if ($SafeLinksPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeLinksPolicy' -Data $SafeLinksPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSafeLinksPolicy' -Data $SafeLinksPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($SafeLinksPolicies.Count) Safe Links policies (detailed)" -sev Debug
+        }
+        $SafeLinksPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Safe Links policy data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSharingPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSharingPolicy.ps1
new file mode 100644
index 000000000000..bd4c28da68f5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoSharingPolicy.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheExoSharingPolicy {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Sharing Policies
+
+    .PARAMETER TenantFilter
+        The tenant to cache sharing policies for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Sharing Policies' -sev Debug
+
+        $SharingPolicies = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-SharingPolicy'
+
+        if ($SharingPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSharingPolicy' -Data $SharingPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoSharingPolicy' -Data $SharingPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($SharingPolicies.Count) Sharing Policies" -sev Debug
+        }
+        $SharingPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Sharing Policies: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoTenantAllowBlockList.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoTenantAllowBlockList.ps1
new file mode 100644
index 000000000000..62b4385a5c8a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoTenantAllowBlockList.ps1
@@ -0,0 +1,52 @@
+function Set-CIPPDBCacheExoTenantAllowBlockList {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Tenant Allow/Block List items
+
+    .PARAMETER TenantFilter
+        The tenant to cache tenant allow/block list for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Tenant Allow/Block List items' -sev Debug
+
+        $SenderItems = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-TenantAllowBlockListItems' -cmdParams @{ListType = 'Sender' }
+        $UrlItems = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-TenantAllowBlockListItems' -cmdParams @{ListType = 'Url' }
+        $FileHashItems = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-TenantAllowBlockListItems' -cmdParams @{ListType = 'FileHash' }
+
+        # Combine all list types into a single collection
+        $AllItems = @()
+        if ($SenderItems) {
+            $AllItems += $SenderItems
+        }
+        if ($UrlItems) {
+            $AllItems += $UrlItems
+        }
+        if ($FileHashItems) {
+            $AllItems += $FileHashItems
+        }
+
+        if ($AllItems.Count -gt 0) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoTenantAllowBlockList' -Data $AllItems
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoTenantAllowBlockList' -Data $AllItems -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AllItems.Count) Tenant Allow/Block List items" -sev Debug
+        } else {
+            # Even if empty, store an empty array so test knows cache was populated
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoTenantAllowBlockList' -Data @()
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoTenantAllowBlockList' -Data @() -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached empty Tenant Allow/Block List' -sev Debug
+        }
+        $SenderItems = $null
+        $UrlItems = $null
+        $FileHashItems = $null
+        $AllItems = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Tenant Allow/Block List: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheExoTransportRules.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoTransportRules.ps1
new file mode 100644
index 000000000000..6f83273af842
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheExoTransportRules.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheExoTransportRules {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online Transport Rules (Mail Flow Rules)
+
+    .PARAMETER TenantFilter
+        The tenant to cache Transport Rules for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Exchange Transport Rules' -sev Debug
+
+        $TransportRules = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-TransportRule'
+
+        if ($TransportRules) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoTransportRules' -Data $TransportRules
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ExoTransportRules' -Data $TransportRules -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($TransportRules.Count) Transport Rules" -sev Debug
+        }
+        $TransportRules = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Transport Rules: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheGroups.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheGroups.ps1
new file mode 100644
index 000000000000..d3be98c3f17e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheGroups.ps1
@@ -0,0 +1,58 @@
+function Set-CIPPDBCacheGroups {
+    <#
+    .SYNOPSIS
+        Caches all groups for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache groups for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching groups' -sev Debug
+
+        $Groups = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999&$select=id,displayName,groupTypes,mail,mailEnabled,securityEnabled,membershipRule,onPremisesSyncEnabled' -tenantid $TenantFilter
+
+        # Build bulk request for group members
+        $MemberRequests = $Groups | ForEach-Object {
+            if ($_.id) {
+                [PSCustomObject]@{
+                    id     = $_.id
+                    method = 'GET'
+                    url    = "/groups/$($_.id)/members?`$select=id,displayName,userPrincipalName"
+                }
+            }
+        }
+
+        if ($MemberRequests) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Fetching group members' -sev Debug
+            $MemberResults = New-GraphBulkRequest -Requests @($MemberRequests) -tenantid $TenantFilter
+
+            # Add members to each group object
+            $GroupsWithMembers = foreach ($Group in $Groups) {
+                $Members = ($MemberResults | Where-Object { $_.id -eq $Group.id }).body.value
+                $Group | Add-Member -NotePropertyName 'members' -NotePropertyValue $Members -Force
+                $Group
+            }
+
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Groups' -Data $GroupsWithMembers
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Groups' -Data $GroupsWithMembers -Count
+            $Groups = $null
+            $GroupsWithMembers = $null
+        } else {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Groups' -Data $Groups
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Groups' -Data $Groups -Count
+            $Groups = $null
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached groups with members successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache groups: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheGuests.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheGuests.ps1
new file mode 100644
index 000000000000..0fc9a324ef6a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheGuests.ps1
@@ -0,0 +1,28 @@
+function Set-CIPPDBCacheGuests {
+    <#
+    .SYNOPSIS
+        Caches all guest users for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache guest users for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching guest users' -sev Debug
+
+        $Guests = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$filter=userType eq 'Guest'&`$expand=sponsors&`$top=999" -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Guests' -Data $Guests
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Guests' -Data $Guests -Count
+        $Guests = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached guest users successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache guest users: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1
new file mode 100644
index 000000000000..1906b3bcdfda
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1
@@ -0,0 +1,39 @@
+function Set-CIPPDBCacheIntuneAppProtectionPolicies {
+    <#
+    .SYNOPSIS
+        Caches Intune App Protection Policies
+
+    .PARAMETER TenantFilter
+        The tenant to cache app protection policies for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Intune App Protection Policies' -sev Debug
+
+        # iOS Managed App Protection Policies
+        $IosPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceAppManagement/iosManagedAppProtections?$expand=assignments' -tenantid $TenantFilter
+        if ($IosPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneIosAppProtectionPolicies' -Data $IosPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneIosAppProtectionPolicies' -Data $IosPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($IosPolicies.Count) iOS app protection policies" -sev Debug
+        }
+        $IosPolicies = $null
+
+        # Android Managed App Protection Policies
+        $AndroidPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceAppManagement/androidManagedAppProtections?$expand=assignments' -tenantid $TenantFilter
+        if ($AndroidPolicies) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneAndroidAppProtectionPolicies' -Data $AndroidPolicies
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneAndroidAppProtectionPolicies' -Data $AndroidPolicies -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AndroidPolicies.Count) Android app protection policies" -sev Debug
+        }
+        $AndroidPolicies = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache App Protection Policies: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheIntunePolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheIntunePolicies.ps1
new file mode 100644
index 000000000000..51c2642f1397
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheIntunePolicies.ps1
@@ -0,0 +1,148 @@
+function Set-CIPPDBCacheIntunePolicies {
+    <#
+    .SYNOPSIS
+        Caches all Intune policies for a tenant (if Intune capable)
+
+    .PARAMETER TenantFilter
+        The tenant to cache Intune policies for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        $TestResult = Test-CIPPStandardLicense -StandardName 'IntunePoliciesCache' -TenantFilter $TenantFilter -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1') -SkipLog
+
+        if ($TestResult -eq $false) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Tenant does not have Intune license, skipping' -sev Debug
+            return
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Intune policies' -sev Debug
+
+        $PolicyTypes = @(
+            @{ Type = 'DeviceCompliancePolicies'; Uri = '/deviceManagement/deviceCompliancePolicies?$top=999&$expand=assignments'; FetchDeviceStatuses = $true }
+            @{ Type = 'DeviceConfigurations'; Uri = '/deviceManagement/deviceConfigurations?$top=999&$expand=assignments' }
+            @{ Type = 'ConfigurationPolicies'; Uri = '/deviceManagement/configurationPolicies?$top=999&$expand=assignments,settings' }
+            @{ Type = 'GroupPolicyConfigurations'; Uri = '/deviceManagement/groupPolicyConfigurations?$top=999&$expand=assignments' }
+            @{ Type = 'MobileAppConfigurations'; Uri = '/deviceManagement/mobileAppConfigurations?$top=999&$expand=assignments' }
+            @{ Type = 'AppProtectionPolicies'; Uri = '/deviceAppManagement/managedAppPolicies?$top=999'; FetchAssignments = $true }
+            @{ Type = 'WindowsAutopilotDeploymentProfiles'; Uri = '/deviceManagement/windowsAutopilotDeploymentProfiles?$top=999&$expand=assignments' }
+            @{ Type = 'DeviceEnrollmentConfigurations'; Uri = '/deviceManagement/deviceEnrollmentConfigurations?$top=999'; FetchAssignments = $true }
+            @{ Type = 'DeviceManagementScripts'; Uri = '/deviceManagement/deviceManagementScripts?$top=999&$expand=assignments' }
+            @{ Type = 'MobileApps'; Uri = '/deviceAppManagement/mobileApps?$top=999&$select=id,displayName,description,publisher,isAssigned,createdDateTime,lastModifiedDateTime'; FetchAssignments = $true }
+        )
+
+        # Build bulk requests for all policy types
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Fetching all policy types using bulk request' -sev Debug
+        $PolicyRequests = foreach ($PolicyType in $PolicyTypes) {
+            [PSCustomObject]@{
+                id     = $PolicyType.Type
+                method = 'GET'
+                url    = $PolicyType.Uri
+            }
+        }
+
+        try {
+            $PolicyResults = New-GraphBulkRequest -Requests @($PolicyRequests) -tenantid $TenantFilter
+        } catch {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to fetch policies in bulk: $($_.Exception.Message)" -sev Error
+            throw
+        }
+
+        # Process each policy type result
+        foreach ($Result in $PolicyResults) {
+            $PolicyType = $PolicyTypes | Where-Object { $_.Type -eq $Result.id }
+            if (-not $PolicyType) { continue }
+
+            try {
+                $Policies = $Result.body.value ?? $Result.body
+
+                if (-not $Policies) {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "No policies found for $($PolicyType.Type)" -sev Debug
+                    continue
+                }
+
+                # Get assignments for policies that don't support expand using bulk requests
+                if ($PolicyType.FetchAssignments -and ($Policies | Measure-Object).Count -gt 0) {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Fetching assignments for $($Policies.Count) $($PolicyType.Type) using bulk request" -sev Debug
+
+                    $BaseUri = ($PolicyType.Uri -split '\?')[0]
+                    # Build bulk request array for assignments
+                    $AssignmentRequests = $Policies | ForEach-Object {
+                        [PSCustomObject]@{
+                            id     = $_.id
+                            method = 'GET'
+                            url    = "$BaseUri/$($_.id)/assignments"
+                        }
+                    }
+
+                    try {
+                        $AssignmentResults = New-GraphBulkRequest -Requests @($AssignmentRequests) -tenantid $TenantFilter
+
+                        if ($AssignmentResults) {
+                            foreach ($AssignResult in $AssignmentResults) {
+                                $Policy = $Policies | Where-Object { $_.id -eq $AssignResult.id }
+                                if ($Policy) {
+                                    $Assignments = $AssignResult.body.value ?? $AssignResult.body
+                                    $Policy | Add-Member -NotePropertyName 'assignments' -NotePropertyValue $Assignments -Force
+                                }
+                            }
+                        }
+                    } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to fetch assignments in bulk for $($PolicyType.Type): $($_.Exception.Message)" -sev Warning
+                    }
+                }
+
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type "Intune$($PolicyType.Type)" -Data $Policies
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type "Intune$($PolicyType.Type)" -Data $Policies -Count
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($Policies.Count) $($PolicyType.Type)" -sev Debug
+
+                # Fetch device statuses for compliance policies using bulk requests
+                if ($PolicyType.FetchDeviceStatuses -and ($Policies | Measure-Object).Count -gt 0) {
+                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Fetching device statuses for $($Policies.Count) compliance policies using bulk request" -sev Debug
+
+                    $BaseUri = ($PolicyType.Uri -split '\?')[0]
+                    # Build bulk request array
+                    $DeviceStatusRequests = $Policies | ForEach-Object {
+                        [PSCustomObject]@{
+                            id     = $_.id
+                            method = 'GET'
+                            url    = "$BaseUri/$($_.id)/deviceStatuses?`$top=999"
+                        }
+                    }
+
+                    try {
+                        $DeviceStatusResults = New-GraphBulkRequest -Requests @($DeviceStatusRequests) -tenantid $TenantFilter
+
+                        if ($DeviceStatusResults) {
+                            foreach ($StatusResult in $DeviceStatusResults) {
+                                $Data = $StatusResult.body.value ?? $StatusResult.body
+                                if ($Data) {
+                                    # Store device statuses with policy ID in the type name (matching extension cache pattern)
+                                    $StatusType = "Intune$($PolicyType.Type)_$($StatusResult.id)"
+                                    Add-CIPPDbItem -TenantFilter $TenantFilter -Type $StatusType -Data $Data
+                                    Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $(($Data | Measure-Object).Count) device statuses for policy ID $($StatusResult.id)" -sev Debug
+                                }
+                            }
+                        }
+                    } catch {
+                        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to fetch device statuses in bulk: $($_.Exception.Message)" -sev Warning
+                    }
+                }
+
+                $Policies = $null
+
+            } catch {
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache $($PolicyType.Type): $($_.Exception.Message)" -sev Warning
+            }
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Intune policies successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Intune policies: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheLicenseOverview.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheLicenseOverview.ps1
new file mode 100644
index 000000000000..5ba1ef461f0b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheLicenseOverview.ps1
@@ -0,0 +1,27 @@
+function Set-CIPPDBCacheLicenseOverview {
+    <#
+    .SYNOPSIS
+        Caches license overview for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache license overview for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching license overview' -sev Debug
+
+        $LicenseOverview = Get-CIPPLicenseOverview -TenantFilter $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'LicenseOverview' -Data @($LicenseOverview)
+        $LicenseOverview = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached license overview successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache license overview: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheMFAState.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheMFAState.ps1
new file mode 100644
index 000000000000..1a430f382a6a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheMFAState.ps1
@@ -0,0 +1,27 @@
+function Set-CIPPDBCacheMFAState {
+    <#
+    .SYNOPSIS
+        Caches MFA state for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache MFA state for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching MFA state' -sev Debug
+
+        $MFAState = Get-CIPPMFAState -TenantFilter $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'MFAState' -Data @($MFAState)
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'MFAState' -Data @($MFAState) -Count
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($MFAState.Count) MFA state records successfully" -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache MFA state: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheMailboxUsage.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheMailboxUsage.ps1
new file mode 100644
index 000000000000..0b8e91fbc176
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheMailboxUsage.ps1
@@ -0,0 +1,27 @@
+function Set-CIPPDBCacheMailboxUsage {
+    <#
+    .SYNOPSIS
+        Caches mailbox usage details for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache mailbox usage for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching mailbox usage' -sev Debug
+
+        $MailboxUsage = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getMailboxUsageDetail(period='D7')?`$format=application%2fjson" -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailboxUsage' -Data $MailboxUsage
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailboxUsage' -Data $MailboxUsage -Count
+        $MailboxUsage = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached mailbox usage successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache mailbox usage: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheMailboxes.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheMailboxes.ps1
new file mode 100644
index 000000000000..071c910c7677
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheMailboxes.ps1
@@ -0,0 +1,97 @@
+function Set-CIPPDBCacheMailboxes {
+    <#
+    .SYNOPSIS
+        Caches all mailboxes, CAS mailboxes, and mailbox permissions for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache mailboxes for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching mailboxes' -sev Debug
+
+        # Get mailboxes with select properties
+        $Select = 'id,ExchangeGuid,ArchiveGuid,UserPrincipalName,DisplayName,PrimarySMTPAddress,RecipientType,RecipientTypeDetails,EmailAddresses,WhenSoftDeleted,IsInactiveMailbox,ForwardingSmtpAddress,DeliverToMailboxAndForward,ForwardingAddress,HiddenFromAddressListsEnabled,ExternalDirectoryObjectId,MessageCopyForSendOnBehalfEnabled,MessageCopyForSentAsEnabled'
+        $ExoRequest = @{
+            tenantid  = $TenantFilter
+            cmdlet    = 'Get-Mailbox'
+            cmdParams = @{}
+            Select    = $Select
+        }
+        $Mailboxes = (New-ExoRequest @ExoRequest) | Select-Object id, ExchangeGuid, ArchiveGuid, WhenSoftDeleted,
+            @{ Name = 'UPN'; Expression = { $_.'UserPrincipalName' } },
+            @{ Name = 'displayName'; Expression = { $_.'DisplayName' } },
+            @{ Name = 'primarySmtpAddress'; Expression = { $_.'PrimarySMTPAddress' } },
+            @{ Name = 'recipientType'; Expression = { $_.'RecipientType' } },
+            @{ Name = 'recipientTypeDetails'; Expression = { $_.'RecipientTypeDetails' } },
+            @{ Name = 'AdditionalEmailAddresses'; Expression = { ($_.'EmailAddresses' | Where-Object { $_ -clike 'smtp:*' }).Replace('smtp:', '') -join ', ' } },
+            @{ Name = 'ForwardingSmtpAddress'; Expression = { $_.'ForwardingSmtpAddress' -replace 'smtp:', '' } },
+            @{ Name = 'InternalForwardingAddress'; Expression = { $_.'ForwardingAddress' } },
+            DeliverToMailboxAndForward,
+            HiddenFromAddressListsEnabled,
+            ExternalDirectoryObjectId,
+            MessageCopyForSendOnBehalfEnabled,
+            MessageCopyForSentAsEnabled
+
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Mailboxes' -Data $Mailboxes
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Mailboxes' -Data $Mailboxes -Count
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($Mailboxes.Count) mailboxes successfully" -sev Debug
+
+        # Get CAS mailboxes
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching CAS mailboxes' -sev Debug
+        $CASMailboxes = New-GraphGetRequest -uri "https://outlook.office365.com/adminapi/beta/$($TenantFilter)/CasMailbox" -Tenantid $TenantFilter -scope 'ExchangeOnline' -noPagination $true
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CASMailbox' -Data $CASMailboxes
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'CASMailbox' -Data $CASMailboxes -Count
+        $CASMailboxes = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached CAS mailboxes successfully' -sev Debug
+
+        # Start orchestrator to cache mailbox permissions in batches
+        $MailboxCount = ($Mailboxes | Measure-Object).Count
+        if ($MailboxCount -gt 0) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Starting mailbox permission caching for $MailboxCount mailboxes" -sev Debug
+            
+            # Create batches of 10 mailboxes each
+            $BatchSize = 10
+            $Batches = [System.Collections.Generic.List[object]]::new()
+            
+            for ($i = 0; $i -lt $Mailboxes.Count; $i += $BatchSize) {
+                $BatchMailboxes = $Mailboxes[$i..[Math]::Min($i + $BatchSize - 1, $Mailboxes.Count - 1)]
+                
+                # Only send UPN to batch function to reduce payload size
+                $BatchMailboxUPNs = $BatchMailboxes | Select-Object -ExpandProperty UPN
+                
+                $Batches.Add([PSCustomObject]@{
+                    FunctionName = 'GetMailboxPermissionsBatch'
+                    TenantFilter = $TenantFilter
+                    Mailboxes    = $BatchMailboxUPNs
+                    BatchNumber  = [Math]::Floor($i / $BatchSize) + 1
+                    TotalBatches = [Math]::Ceiling($Mailboxes.Count / $BatchSize)
+                })
+            }
+            
+            $InputObject = [PSCustomObject]@{
+                Batch            = $Batches
+                OrchestratorName = "MailboxPermissions_$TenantFilter"
+                DurableMode      = 'Sequence'
+                PostExecution    = @{
+                    FunctionName = 'StoreMailboxPermissions'
+                    Parameters   = @{
+                        TenantFilter = $TenantFilter
+                    }
+                }
+            }
+            Start-NewOrchestration -FunctionName 'CIPPOrchestrator' -InputObject ($InputObject | ConvertTo-Json -Compress -Depth 5)
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Started mailbox permission caching orchestrator with $($Batches.Count) batches" -sev Debug
+        } else {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No mailboxes found to cache permissions for' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache mailboxes: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheManagedDeviceEncryptionStates.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheManagedDeviceEncryptionStates.ps1
new file mode 100644
index 000000000000..4e4f78f33c2a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheManagedDeviceEncryptionStates.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheManagedDeviceEncryptionStates {
+    <#
+    .SYNOPSIS
+        Caches encryption states (BitLocker/FileVault) for managed devices in a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache managed device encryption states for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching managed device encryption states' -sev Debug
+
+        $ManagedDeviceEncryptionStates = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/managedDeviceEncryptionStates?$top=999' -tenantid $TenantFilter
+
+        if ($ManagedDeviceEncryptionStates) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ManagedDeviceEncryptionStates' -Data $ManagedDeviceEncryptionStates
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ManagedDeviceEncryptionStates' -Data $ManagedDeviceEncryptionStates -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($ManagedDeviceEncryptionStates.Count) managed device encryption states" -sev Debug
+        }
+        $ManagedDeviceEncryptionStates = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache managed device encryption states: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheManagedDevices.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheManagedDevices.ps1
new file mode 100644
index 000000000000..3e41edab2337
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheManagedDevices.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheManagedDevices {
+    <#
+    .SYNOPSIS
+        Caches all Intune managed devices for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache managed devices for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching managed devices' -sev Debug
+        $ManagedDevices = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/deviceManagement/managedDevices?$top=999&$select=id,deviceName,operatingSystem,osVersion,complianceState,managedDeviceOwnerType,enrolledDateTime,lastSyncDateTime' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ManagedDevices' -Data $ManagedDevices
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ManagedDevices' -Data $ManagedDevices -Count
+        $ManagedDevices = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached managed devices successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache managed devices: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheOAuth2PermissionGrants.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheOAuth2PermissionGrants.ps1
new file mode 100644
index 000000000000..78ea6366ae5d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheOAuth2PermissionGrants.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheOAuth2PermissionGrants {
+    <#
+    .SYNOPSIS
+        Caches OAuth2 permission grants (delegated permissions) for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache OAuth2 permission grants for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching OAuth2 permission grants' -sev Debug
+
+        $OAuth2PermissionGrants = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/oauth2PermissionGrants?$top=999' -tenantid $TenantFilter
+
+        if ($OAuth2PermissionGrants) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OAuth2PermissionGrants' -Data $OAuth2PermissionGrants
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OAuth2PermissionGrants' -Data $OAuth2PermissionGrants -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($OAuth2PermissionGrants.Count) OAuth2 permission grants" -sev Debug
+        }
+        $OAuth2PermissionGrants = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache OAuth2 permission grants: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheOneDriveUsage.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheOneDriveUsage.ps1
new file mode 100644
index 000000000000..4df2d347f02e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheOneDriveUsage.ps1
@@ -0,0 +1,27 @@
+function Set-CIPPDBCacheOneDriveUsage {
+    <#
+    .SYNOPSIS
+        Caches OneDrive usage details for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache OneDrive usage for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching OneDrive usage' -sev Debug
+
+        $OneDriveUsage = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getOneDriveUsageAccountDetail(period='D7')?`$format=application%2fjson" -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveUsage' -Data $OneDriveUsage
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveUsage' -Data $OneDriveUsage -Count
+        $OneDriveUsage = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached OneDrive usage successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache OneDrive usage: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheOrganization.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheOrganization.ps1
new file mode 100644
index 000000000000..4710caf76427
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheOrganization.ps1
@@ -0,0 +1,28 @@
+function Set-CIPPDBCacheOrganization {
+    <#
+    .SYNOPSIS
+        Caches organization information for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache organization data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching organization data' -sev Debug
+
+        $Organization = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/organization' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Organization' -Data $Organization
+        $Organization = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached organization data successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache organization data: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCachePIMSettings.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCachePIMSettings.ps1
new file mode 100644
index 000000000000..224d357389d6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCachePIMSettings.ps1
@@ -0,0 +1,56 @@
+function Set-CIPPDBCachePIMSettings {
+    <#
+    .SYNOPSIS
+        Caches PIM (Privileged Identity Management) settings for a tenant (if CA capable)
+
+    .PARAMETER TenantFilter
+        The tenant to cache PIM settings for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        $TestResult = Test-CIPPStandardLicense -StandardName 'PIMSettingsCache' -TenantFilter $TenantFilter -RequiredCapabilities @('AAD_PREMIUM_P2') -SkipLog
+
+        if ($TestResult -eq $false) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Tenant does not have Azure AD Premium P2 license, skipping PIM' -sev Debug
+            return
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching PIM settings' -sev Debug
+
+        try {
+            $PIMRoleSettings = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/roleManagementPolicyAssignments?$top=999' -tenantid $TenantFilter
+
+            if ($PIMRoleSettings) {
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMRoleSettings' -Data $PIMRoleSettings
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMRoleSettings' -Data $PIMRoleSettings -Count
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($PIMRoleSettings.Count) PIM role settings" -sev Debug
+            }
+            $PIMRoleSettings = $null
+        } catch {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache PIM role settings: $($_.Exception.Message)" -sev Warning
+        }
+
+        try {
+            $PIMAssignments = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleEligibilityScheduleInstances?$top=999' -tenantid $TenantFilter
+
+            if ($PIMAssignments) {
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMAssignments' -Data $PIMAssignments
+                Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'PIMAssignments' -Data $PIMAssignments -Count
+                Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($PIMAssignments.Count) PIM assignments" -sev Debug
+            }
+            $PIMAssignments = $null
+        } catch {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache PIM assignments: $($_.Exception.Message)" -sev Warning
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached PIM settings successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache PIM settings: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskDetections.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskDetections.ps1
new file mode 100644
index 000000000000..2acc5fa2f099
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskDetections.ps1
@@ -0,0 +1,35 @@
+function Set-CIPPDBCacheRiskDetections {
+    <#
+    .SYNOPSIS
+        Caches risk detections from Identity Protection for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache risk detections for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching risk detections from Identity Protection' -sev Debug
+
+        # Requires P2 licensing
+        $RiskDetections = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identityProtection/riskDetections' -tenantid $TenantFilter
+
+        if ($RiskDetections) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RiskDetections' -Data $RiskDetections
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RiskDetections' -Data $RiskDetections -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($RiskDetections.Count) risk detections successfully" -sev Debug
+        } else {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No risk detections found or Identity Protection not available' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache risk detections: $($_.Exception.Message)" `
+            -sev Warning `
+            -LogData (Get-CippException -Exception $_)
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskyServicePrincipals.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskyServicePrincipals.ps1
new file mode 100644
index 000000000000..09092dd18716
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskyServicePrincipals.ps1
@@ -0,0 +1,35 @@
+function Set-CIPPDBCacheRiskyServicePrincipals {
+    <#
+    .SYNOPSIS
+        Caches risky service principals from Identity Protection for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache risky service principals for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching risky service principals from Identity Protection' -sev Debug
+
+        # Requires Workload Identity Premium licensing
+        $RiskyServicePrincipals = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identityProtection/riskyServicePrincipals' -tenantid $TenantFilter
+
+        if ($RiskyServicePrincipals) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RiskyServicePrincipals' -Data $RiskyServicePrincipals
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RiskyServicePrincipals' -Data $RiskyServicePrincipals -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($RiskyServicePrincipals.Count) risky service principals successfully" -sev Debug
+        } else {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No risky service principals found or Workload Identity Protection not available' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache risky service principals: $($_.Exception.Message)" `
+            -sev Warning `
+            -LogData (Get-CippException -Exception $_)
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskyUsers.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskyUsers.ps1
new file mode 100644
index 000000000000..813dff9da5ac
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheRiskyUsers.ps1
@@ -0,0 +1,35 @@
+function Set-CIPPDBCacheRiskyUsers {
+    <#
+    .SYNOPSIS
+        Caches risky users from Identity Protection for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache risky users for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching risky users from Identity Protection' -sev Debug
+
+        # Requires P2 or Governance licensing
+        $RiskyUsers = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identityProtection/riskyUsers' -tenantid $TenantFilter
+
+        if ($RiskyUsers) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RiskyUsers' -Data $RiskyUsers
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RiskyUsers' -Data $RiskyUsers -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($RiskyUsers.Count) risky users successfully" -sev Debug
+        } else {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No risky users found or Identity Protection not available' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache risky users: $($_.Exception.Message)" `
+            -sev Warning `
+            -LogData (Get-CippException -Exception $_)
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleAssignmentScheduleInstances.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleAssignmentScheduleInstances.ps1
new file mode 100644
index 000000000000..6d269f2cf17c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleAssignmentScheduleInstances.ps1
@@ -0,0 +1,28 @@
+function Set-CIPPDBCacheRoleAssignmentScheduleInstances {
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        $RoleAssignmentScheduleInstances = New-GraphGetRequest -Uri 'https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignmentScheduleInstances' -tenantid $TenantFilter
+
+        $Body = [pscustomobject]@{
+            Tenant        = $TenantFilter
+            LastRefresh   = (Get-Date).ToUniversalTime()
+            Type          = 'RoleAssignmentScheduleInstances'
+            Data          = [System.Text.Encoding]::UTF8.GetBytes(($RoleAssignmentScheduleInstances | ConvertTo-Json -Compress -Depth 10))
+            PartitionKey  = 'TenantCache'
+            RowKey        = ('{0}-{1}' -f $TenantFilter, 'RoleAssignmentScheduleInstances')
+            SchemaVersion = [int]1
+            SentAsDate    = [string](Get-Date -UFormat '+%Y-%m-%dT%H:%M:%S.000Z')
+        }
+
+        $null = Add-CIPPAzDataTableEntity @CacheTableDetails -Entity $Body -Force
+        Write-LogMessage -API 'DBCache' -tenant $TenantFilter -message 'Role assignment schedule instances cache updated' -sev Debug
+    } catch {
+        Write-LogMessage -API 'DBCache' -tenant $TenantFilter -message "Error caching role assignment schedule instances: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleEligibilitySchedules.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleEligibilitySchedules.ps1
new file mode 100644
index 000000000000..a4f559b5bd6b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleEligibilitySchedules.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheRoleEligibilitySchedules {
+    <#
+    .SYNOPSIS
+        Caches role eligibility schedules for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache role eligibility schedules for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching role eligibility schedules' -sev Debug
+        $RoleEligibilitySchedules = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/roleManagement/directory/roleEligibilitySchedules' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RoleEligibilitySchedules' -Data @($RoleEligibilitySchedules)
+        $RoleEligibilitySchedules = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached role eligibility schedules successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache role eligibility schedules: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleManagementPolicies.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleManagementPolicies.ps1
new file mode 100644
index 000000000000..a2c3f97b99d5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoleManagementPolicies.ps1
@@ -0,0 +1,26 @@
+function Set-CIPPDBCacheRoleManagementPolicies {
+    <#
+    .SYNOPSIS
+        Caches role management policies for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache role management policies for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching role management policies' -sev Debug
+        $RoleManagementPolicies = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/roleManagementPolicies' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'RoleManagementPolicies' -Data @($RoleManagementPolicies)
+        $RoleManagementPolicies = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached role management policies successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache role management policies: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheRoles.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoles.ps1
new file mode 100644
index 000000000000..f9f6bd66c77d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheRoles.ps1
@@ -0,0 +1,63 @@
+function Set-CIPPDBCacheRoles {
+    <#
+    .SYNOPSIS
+        Caches all directory roles and their members for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache role data for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching directory roles' -sev Debug
+
+        $Roles = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/directoryRoles' -tenantid $TenantFilter
+
+        # Build bulk request for role members
+        $MemberRequests = $Roles | ForEach-Object {
+            if ($_.id) {
+                [PSCustomObject]@{
+                    id     = $_.id
+                    method = 'GET'
+                    url    = "/directoryRoles/$($_.id)/members?`$select=id,displayName,userPrincipalName"
+                }
+            }
+        }
+
+        if ($MemberRequests) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Fetching role members' -sev Debug
+            $MemberResults = New-GraphBulkRequest -Requests @($MemberRequests) -tenantid $TenantFilter
+
+            # Add members to each role object
+            $RolesWithMembers = foreach ($Role in $Roles) {
+                $Members = ($MemberResults | Where-Object { $_.id -eq $Role.id }).body.value
+                [PSCustomObject]@{
+                    id             = $Role.id
+                    displayName    = $Role.displayName
+                    description    = $Role.description
+                    roleTemplateId = $Role.roleTemplateId
+                    members        = $Members
+                    memberCount    = ($Members | Measure-Object).Count
+                }
+            }
+
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Roles' -Data $RolesWithMembers
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Roles' -Data $RolesWithMembers -Count
+            $Roles = $null
+            $RolesWithMembers = $null
+        } else {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Roles' -Data $Roles
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Roles' -Data $Roles -Count
+            $Roles = $null
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached directory roles successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache directory roles: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheSecureScore.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheSecureScore.ps1
new file mode 100644
index 000000000000..de3eab54f0ed
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheSecureScore.ps1
@@ -0,0 +1,35 @@
+function Set-CIPPDBCacheSecureScore {
+    <#
+    .SYNOPSIS
+        Caches secure score history (last 14 days) and control profiles for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache secure score for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching secure score' -sev Debug
+
+        # Cache secure score history (last 14 days)
+        $SecureScore = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/security/secureScores?$top=14' -tenantid $TenantFilter -noPagination $true
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SecureScore' -Data $SecureScore
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SecureScore' -Data $SecureScore -Count
+        $SecureScore = $null
+
+        # Cache secure score control profiles
+        $SecureScoreControlProfiles = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/security/secureScoreControlProfiles' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SecureScoreControlProfiles' -Data $SecureScoreControlProfiles
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SecureScoreControlProfiles' -Data $SecureScoreControlProfiles -Count
+        $SecureScoreControlProfiles = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached secure score and control profiles successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache secure score: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheServicePrincipalRiskDetections.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheServicePrincipalRiskDetections.ps1
new file mode 100644
index 000000000000..a437723e0abd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheServicePrincipalRiskDetections.ps1
@@ -0,0 +1,35 @@
+function Set-CIPPDBCacheServicePrincipalRiskDetections {
+    <#
+    .SYNOPSIS
+        Caches service principal risk detections from Identity Protection for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache service principal risk detections for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching service principal risk detections from Identity Protection' -sev Debug
+
+        # Requires Workload Identity Premium licensing
+        $ServicePrincipalRiskDetections = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identityProtection/servicePrincipalRiskDetections' -tenantid $TenantFilter
+
+        if ($ServicePrincipalRiskDetections) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ServicePrincipalRiskDetections' -Data $ServicePrincipalRiskDetections
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ServicePrincipalRiskDetections' -Data $ServicePrincipalRiskDetections -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($ServicePrincipalRiskDetections.Count) service principal risk detections successfully" -sev Debug
+        } else {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'No service principal risk detections found or Workload Identity Protection not available' -sev Debug
+        }
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache service principal risk detections: $($_.Exception.Message)" `
+            -sev Warning `
+            -LogData (Get-CippException -Exception $_)
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheServicePrincipals.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheServicePrincipals.ps1
new file mode 100644
index 000000000000..b91941940e66
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheServicePrincipals.ps1
@@ -0,0 +1,29 @@
+function Set-CIPPDBCacheServicePrincipals {
+    <#
+    .SYNOPSIS
+        Caches all service principals for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache service principals for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching service principals' -sev Debug
+
+        $ServicePrincipals = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ServicePrincipals' -Data $ServicePrincipals
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ServicePrincipals' -Data $ServicePrincipals -Count
+        $ServicePrincipals = $null
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached service principals successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache service principals: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheSettings.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheSettings.ps1
new file mode 100644
index 000000000000..08aee0f383a7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheSettings.ps1
@@ -0,0 +1,27 @@
+function Set-CIPPDBCacheSettings {
+    <#
+    .SYNOPSIS
+        Caches directory settings for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache settings for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching directory settings' -sev Debug
+
+        $Settings = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/settings?$top=999' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Settings' -Data $Settings
+        $Settings = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached directory settings successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter `
+            -message "Failed to cache directory settings: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheUserRegistrationDetails.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheUserRegistrationDetails.ps1
new file mode 100644
index 000000000000..818a441dc0f3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheUserRegistrationDetails.ps1
@@ -0,0 +1,30 @@
+function Set-CIPPDBCacheUserRegistrationDetails {
+    <#
+    .SYNOPSIS
+        Caches authentication method registration details for all users in a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache user registration details for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching user registration details' -sev Debug
+
+        $UserRegistrationDetails = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails' -tenantid $TenantFilter
+
+        if ($UserRegistrationDetails) {
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'UserRegistrationDetails' -Data $UserRegistrationDetails
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'UserRegistrationDetails' -Data $UserRegistrationDetails -Count
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($UserRegistrationDetails.Count) user registration details" -sev Debug
+        }
+        $UserRegistrationDetails = $null
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache user registration details: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPDBCacheUsers.ps1 b/Modules/CIPPCore/Public/Set-CIPPDBCacheUsers.ps1
new file mode 100644
index 000000000000..a1ffd11ef337
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPDBCacheUsers.ps1
@@ -0,0 +1,27 @@
+function Set-CIPPDBCacheUsers {
+    <#
+    .SYNOPSIS
+        Caches all users for a tenant
+
+    .PARAMETER TenantFilter
+        The tenant to cache users for
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching users' -sev Debug
+
+        $Users = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/users?$top=999' -tenantid $TenantFilter
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Users' -Data $Users
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'Users' -Data $Users -Count
+        $Users = $null
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached users successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache users: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPMailboxRule.ps1 b/Modules/CIPPCore/Public/Set-CIPPMailboxRule.ps1
index cbbd39cd0916..b7b0f4810c15 100644
--- a/Modules/CIPPCore/Public/Set-CIPPMailboxRule.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPMailboxRule.ps1
@@ -22,7 +22,7 @@
     }
 
     try {
-        $null = New-ExoRequest -tenantid $TenantFilter -cmdlet "$State-InboxRule" -Anchor $Username -cmdParams @{Identity = $RuleId }
+        $null = New-ExoRequest -tenantid $TenantFilter -cmdlet "$State-InboxRule" -Anchor $Username -cmdParams @{Identity = $RuleId; mailbox = $UserId } -Headers $Headers
         Write-LogMessage -headers $Headers -API $APIName -message "Successfully set mailbox rule $($RuleName) for $($Username) to $($State)d" -Sev 'Info' -tenant $TenantFilter
         return "Successfully set mailbox rule $($RuleName) for $($Username) to $($State)d"
     } catch {
diff --git a/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1 b/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1
index 5bf3b8635f6e..a12bd21aaefb 100644
--- a/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPStandardsCompareField.ps1
@@ -2,15 +2,19 @@ function Set-CIPPStandardsCompareField {
     [CmdletBinding(SupportsShouldProcess = $true)]
     param (
         $FieldName,
-        $FieldValue,
+        $FieldValue, #FieldValue is here for backward compatibility.
+        $CurrentValue, #The latest actual value in raw json
+        $ExpectedValue, #The expected value - e.g. the settings object from our standard
         $TenantFilter,
         [Parameter()]
+        [bool]$LicenseAvailable = $true,
+        [Parameter()]
         [array]$BulkFields
     )
     $Table = Get-CippTable -tablename 'CippStandardsReports'
     $TenantName = Get-Tenants -TenantFilter $TenantFilter
 
-    # Helper function to normalize field values
+    # Helper function to normalize field values. This can go in a couple of releases tbh.
     function ConvertTo-NormalizedFieldValue {
         param($Value)
         if ($Value -is [System.Boolean]) {
@@ -23,6 +27,13 @@ function Set-CIPPStandardsCompareField {
         }
     }
 
+    if ($CurrentValue -and $CurrentValue -isnot [string]) {
+        $CurrentValue = [string](ConvertTo-Json -InputObject $CurrentValue -Depth 10 -Compress)
+    }
+    if ($ExpectedValue -and $ExpectedValue -isnot [string]) {
+        $ExpectedValue = [string](ConvertTo-Json -InputObject $ExpectedValue -Depth 10 -Compress)
+    }
+
     # Handle bulk operations
     if ($BulkFields) {
         # Get all existing entities for this tenant in one query
@@ -34,20 +45,26 @@ function Set-CIPPStandardsCompareField {
 
         # Build array of entities to insert/update
         $EntitiesToProcess = [System.Collections.Generic.List[object]]::new()
-        
+
         foreach ($Field in $BulkFields) {
             $NormalizedValue = ConvertTo-NormalizedFieldValue -Value $Field.FieldValue
-            
+
             if ($ExistingHash.ContainsKey($Field.FieldName)) {
                 $Entity = $ExistingHash[$Field.FieldName]
                 $Entity.Value = $NormalizedValue
                 $Entity | Add-Member -NotePropertyName TemplateId -NotePropertyValue ([string]$script:CippStandardInfoStorage.Value.StandardTemplateId) -Force
+                $Entity | Add-Member -NotePropertyName LicenseAvailable -NotePropertyValue ([bool]$Field.LicenseAvailable) -Force
+                $Entity | Add-Member -NotePropertyName CurrentValue -NotePropertyValue ([string]$Field.CurrentValue) -Force
+                $Entity | Add-Member -NotePropertyName ExpectedValue -NotePropertyValue ([string]$Field.ExpectedValue) -Force
             } else {
                 $Entity = [PSCustomObject]@{
-                    PartitionKey = [string]$TenantName.defaultDomainName
-                    RowKey       = [string]$Field.FieldName
-                    Value        = $NormalizedValue
-                    TemplateId   = [string]$script:CippStandardInfoStorage.Value.StandardTemplateId
+                    PartitionKey     = [string]$TenantName.defaultDomainName
+                    RowKey           = [string]$Field.FieldName
+                    Value            = $NormalizedValue
+                    TemplateId       = [string]$script:CippStandardInfoStorage.Value.StandardTemplateId
+                    LicenseAvailable = [bool]$Field.LicenseAvailable
+                    CurrentValue     = [string]$Field.CurrentValue
+                    ExpectedValue    = [string]$Field.ExpectedValue
                 }
             }
             $EntitiesToProcess.Add($Entity)
@@ -72,13 +89,19 @@ function Set-CIPPStandardsCompareField {
                 if ($Existing) {
                     $Existing.Value = $NormalizedValue
                     $Existing | Add-Member -NotePropertyName TemplateId -NotePropertyValue ([string]$script:CippStandardInfoStorage.Value.StandardTemplateId) -Force
+                    $Existing | Add-Member -NotePropertyName LicenseAvailable -NotePropertyValue ([bool]$LicenseAvailable) -Force
+                    $Existing | Add-Member -NotePropertyName CurrentValue -NotePropertyValue ([string]$CurrentValue) -Force
+                    $Existing | Add-Member -NotePropertyName ExpectedValue -NotePropertyValue ([string]$ExpectedValue) -Force
                     Add-CIPPAzDataTableEntity @Table -Entity $Existing -Force
                 } else {
                     $Result = [PSCustomObject]@{
-                        PartitionKey = [string]$TenantName.defaultDomainName
-                        RowKey       = [string]$FieldName
-                        Value        = $NormalizedValue
-                        TemplateId   = [string]$script:CippStandardInfoStorage.Value.StandardTemplateId
+                        PartitionKey     = [string]$TenantName.defaultDomainName
+                        RowKey           = [string]$FieldName
+                        Value            = $NormalizedValue
+                        TemplateId       = [string]$script:CippStandardInfoStorage.Value.StandardTemplateId
+                        LicenseAvailable = [bool]$LicenseAvailable
+                        CurrentValue     = [string]$CurrentValue
+                        ExpectedValue    = [string]$ExpectedValue
                     }
                     Add-CIPPAzDataTableEntity @Table -Entity $Result -Force
                 }
diff --git a/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1 b/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1
index 19b9db51942c..e72fb7b69701 100644
--- a/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPUserLicense.ps1
@@ -55,5 +55,5 @@ function Set-CIPPUserLicense {
     }
 
     Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Assigned licenses to user $UserId. Added: $AddLicenses; Removed: $RemoveLicenses" -Sev 'Info'
-    return 'Set licenses successfully'
+    return "Successfully set licenses for $UserId. It may take 2–5 minutes before the changes become visible."
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
index 0bdf7e92a3eb..d89d9804bc15 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
@@ -53,7 +53,9 @@ function Invoke-CIPPStandardActivityBasedTimeout {
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the ActivityBasedTimeout state for $Tenant. Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage
         return
     }
-    $StateIsCorrect = if ($CurrentState.definition -like "*$timeout*") { $true } else { $false }
+    $CurrentValue = ($CurrentState.definition | ConvertFrom-Json -ErrorAction SilentlyContinue).activitybasedtimeoutpolicy.ApplicationPolicies | Select-Object -First 1 -Property WebSessionIdleTimeout
+    $StateIsCorrect = if ($CurrentValue.WebSessionIdleTimeout -eq $timeout) { $true } else { $false }
+    $ExpectedValue = [PSCustomObject]@{WebSessionIdleTimeout = $timeout }
 
     if ($Settings.remediate -eq $true) {
         try {
@@ -97,7 +99,7 @@ function Invoke-CIPPStandardActivityBasedTimeout {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.ActivityBasedTimeout' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.ActivityBasedTimeout' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'ActivityBasedTimeout' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
index 4485efc83044..fbaf8ce3251a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
@@ -112,6 +112,17 @@ function Invoke-CIPPStandardAddDKIM {
     $NewDomains = $AllDomains | Where-Object { $DKIM.Domain -notcontains $_ }
     $SetDomains = $DKIM | Where-Object { $AllDomains -contains $_.Domain -and $_.Enabled -eq $false }
 
+    $MissingDKIM = [System.Collections.Generic.List[string]]::new()
+    if ($null -ne $NewDomains) {
+        $MissingDKIM.AddRange($NewDomains)
+    }
+    if ($null -ne $SetDomains) {
+        $MissingDKIM.AddRange($SetDomains.Domain)
+    }
+
+    $CurrentValue = if ($MissingDKIM.Count -eq 0) { [PSCustomObject]@{'state' = 'Configured correctly' } } else { [PSCustomObject]@{'MissingDKIM' = $MissingDKIM } }
+    $ExpectedValue = [PSCustomObject]@{'state' = 'Configured correctly' }
+
     if ($Settings.remediate -eq $true) {
 
         if ($null -eq $NewDomains -and $null -eq $SetDomains) {
@@ -179,7 +190,7 @@ function Invoke-CIPPStandardAddDKIM {
 
     if ($Settings.report -eq $true) {
         $DKIMState = if ($null -eq $NewDomains -and $null -eq $SetDomains) { $true } else { $SetDomains, $NewDomains }
-        Set-CIPPStandardsCompareField -FieldName 'standards.AddDKIM' -FieldValue $DKIMState -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AddDKIM' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'DKIM' -FieldValue $DKIMState -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1
index 1b7e98d18c06..288053375351 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1
@@ -92,6 +92,9 @@ function Invoke-CIPPStandardAddDMARCToMOERA {
         }
         # Check if match is true and there is only one DMARC record for each domain
         $StateIsCorrect = $false -notin $CurrentInfo.Match -and $CurrentInfo.Count -eq $Domains.Count
+
+        $CurrentValue = if ($StateIsCorrect) { [PSCustomObject]@{'state' = 'Configured correctly' } } else { [PSCustomObject]@{'MissingDMARC' = @($CurrentInfo | Where-Object -Property Match -EQ $false | Select-Object -ExpandProperty DomainName) } }
+        $ExpectedValue = [PSCustomObject]@{'state' = 'Configured correctly' }
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         if ($_.Exception.Message -like '*403*') {
@@ -156,7 +159,7 @@ function Invoke-CIPPStandardAddDMARCToMOERA {
     }
 
     if ($Settings.report -eq $true) {
-        set-CIPPStandardsCompareField -FieldName 'standards.AddDMARCToMOERA' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AddDMARCToMOERA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AddDMARCToMOERA' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1
index 05d16fd877de..6d924f41cdef 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1
@@ -41,6 +41,9 @@ function Invoke-CIPPStandardAnonReportDisable {
         return
     }
 
+    $CurrentValue = $CurrentInfo | Select-Object -Property displayConcealedNames
+    $ExpectedValue = [PSCustomObject]@{displayConcealedNames = $false }
+
     if ($Settings.remediate -eq $true) {
 
         if ($CurrentInfo.displayConcealedNames -eq $false) {
@@ -65,8 +68,7 @@ function Invoke-CIPPStandardAnonReportDisable {
         }
     }
     if ($Settings.report -eq $true) {
-        $StateIsCorrect = $CurrentInfo.displayConcealedNames ? $false : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.AnonReportDisable' -FieldValue $StateIsCorrect -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AnonReportDisable' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'AnonReport' -FieldValue $CurrentInfo.displayConcealedNames -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
index 34a1fa83cdd9..79f02f28e15f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
@@ -115,6 +115,33 @@ function Invoke-CIPPStandardAntiPhishPolicy {
                           ($CurrentState.EnableTargetedDomainsProtection -eq $true) -and
                           ($CurrentState.EnableTargetedUserProtection -eq $true) -and
                           ($CurrentState.EnableOrganizationDomainsProtection -eq $true)
+
+        $CurrentValue = $CurrentState | Select-Object Name, Enabled, PhishThresholdLevel, EnableMailboxIntelligence, EnableMailboxIntelligenceProtection, EnableSpoofIntelligence, EnableFirstContactSafetyTips, EnableSimilarUsersSafetyTips, EnableSimilarDomainsSafetyTips, EnableUnusualCharactersSafetyTips, EnableUnauthenticatedSender, EnableViaTag, AuthenticationFailAction, SpoofQuarantineTag, MailboxIntelligenceProtectionAction, MailboxIntelligenceQuarantineTag, TargetedUserProtectionAction, TargetedUserQuarantineTag, TargetedDomainProtectionAction, TargetedDomainQuarantineTag, EnableOrganizationDomainsProtection, EnableTargetedDomainsProtection, EnableTargetedUserProtection
+        $ExpectedValue = [PSCustomObject]@{
+            Name                                 = $PolicyName
+            Enabled                              = $true
+            PhishThresholdLevel                  = $Settings.PhishThresholdLevel
+            EnableMailboxIntelligence            = $true
+            EnableMailboxIntelligenceProtection  = $true
+            EnableSpoofIntelligence              = $true
+            EnableFirstContactSafetyTips         = $Settings.EnableFirstContactSafetyTips
+            EnableSimilarUsersSafetyTips         = $Settings.EnableSimilarUsersSafetyTips
+            EnableSimilarDomainsSafetyTips       = $Settings.EnableSimilarDomainsSafetyTips
+            EnableUnusualCharactersSafetyTips    = $Settings.EnableUnusualCharactersSafetyTips
+            EnableUnauthenticatedSender          = $true
+            EnableViaTag                         = $true
+            AuthenticationFailAction             = $Settings.AuthenticationFailAction
+            SpoofQuarantineTag                   = $Settings.SpoofQuarantineTag
+            MailboxIntelligenceProtectionAction  = $Settings.MailboxIntelligenceProtectionAction
+            MailboxIntelligenceQuarantineTag     = $Settings.MailboxIntelligenceQuarantineTag
+            TargetedUserProtectionAction         = $Settings.TargetedUserProtectionAction
+            TargetedUserQuarantineTag            = $Settings.TargetedUserQuarantineTag
+            TargetedDomainProtectionAction       = $Settings.TargetedDomainProtectionAction
+            TargetedDomainQuarantineTag          = $Settings.TargetedDomainQuarantineTag
+            EnableTargetedDomainsProtection      = $true
+            EnableTargetedUserProtection         = $true
+            EnableOrganizationDomainsProtection  = $true
+        }
     } else {
         $StateIsCorrect = ($CurrentState.Name -eq $PolicyName) -and
                           ($CurrentState.Enabled -eq $true) -and
@@ -124,6 +151,17 @@ function Invoke-CIPPStandardAntiPhishPolicy {
                           ($CurrentState.EnableViaTag -eq $true) -and
                           ($CurrentState.AuthenticationFailAction -eq $Settings.AuthenticationFailAction) -and
                           ($CurrentState.SpoofQuarantineTag -eq $Settings.SpoofQuarantineTag)
+        $CurrentValue = $CurrentState | Select-Object Name, Enabled, EnableSpoofIntelligence, EnableFirstContactSafetyTips, EnableUnauthenticatedSender, EnableViaTag, AuthenticationFailAction, SpoofQuarantineTag
+        $ExpectedValue = [PSCustomObject]@{
+            Name                        = $PolicyName
+            Enabled                     = $true
+            EnableSpoofIntelligence     = $true
+            EnableFirstContactSafetyTips= $Settings.EnableFirstContactSafetyTips
+            EnableUnauthenticatedSender = $true
+            EnableViaTag                = $true
+            AuthenticationFailAction    = $Settings.AuthenticationFailAction
+            SpoofQuarantineTag          = $Settings.SpoofQuarantineTag
+        }
     }
 
     $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain'
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1
index 768dd1c9628c..614a1a7f036c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1
@@ -56,9 +56,15 @@ function Invoke-CIPPStandardAntiSpamSafeList {
     }
     $WantedState = $State -eq $true ? $true : $false
     $StateIsCorrect = if ($CurrentState -eq $WantedState) { $true } else { $false }
+    $CurrentValue = [PSCustomObject]@{
+        EnableSafeList = $CurrentState
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        EnableSafeList = $WantedState
+    }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.AntiSpamSafeList' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AntiSpamSafeList' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AntiSpamSafeList' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1
index af96e1e1ab7c..c01aade26629 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1
@@ -39,6 +39,8 @@ function Invoke-CIPPStandardAppDeploy {
     $AppExists = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/servicePrincipals?$top=999' -tenantid $Tenant
     $Mode = $Settings.mode ?? 'copy'
 
+    $ExpectedValue = [PSCustomObject]@{ state = 'Configured correctly' }
+
     if ($Mode -eq 'template') {
         # For template mode, we need to check each template individually
         # since Gallery Templates and Enterprise Apps have different deployment methods
@@ -105,6 +107,9 @@ function Invoke-CIPPStandardAppDeploy {
             }
         }
     }
+
+    $CurrentValue = if ($MissingApps.Count -eq 0) { [PSCustomObject]@{'state' = 'Configured correctly' } } else { [PSCustomObject]@{'MissingApps' = $MissingApps } }
+
     if ($Settings.remediate -eq $true) {
         if ($Mode -eq 'copy') {
             foreach ($App in $AppsToAdd) {
@@ -279,7 +284,7 @@ function Invoke-CIPPStandardAppDeploy {
 
     if ($Settings.report -eq $true) {
         $StateIsCorrect = $MissingApps.Count -eq 0 ? $true : @{ 'Missing Apps' = $MissingApps -join ',' }
-        Set-CIPPStandardsCompareField -FieldName 'standards.AppDeploy' -FieldValue $StateIsCorrect -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AppDeploy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'AppDeploy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1
index 5cececa9417b..8d371752daa4 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1
@@ -40,6 +40,15 @@ function Invoke-CIPPStandardAssignmentFilterTemplate {
     $Filter = "PartitionKey eq 'AssignmentFilterTemplate' and (RowKey eq '$($Settings.TemplateList.value -join "' or RowKey eq '")')"
     $AssignmentFilterTemplates = (Get-CIPPAzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
 
+    $ExpectedValue = [PSCustomObject]@{ state = 'Configured correctly' }
+    $MissingFilters = $AssignmentFilterTemplates | Where-Object {
+        $CheckExisting = $existingFilters | Where-Object { $_.displayName -eq $_.displayName }
+        if (!$CheckExisting) {
+            $_.displayName
+        }
+    }
+    $CurrentValue = if ($MissingFilters.Count -eq 0) { [PSCustomObject]@{'state' = 'Configured correctly' } } else { [PSCustomObject]@{'MissingFilters' = @($MissingFilters) } }
+
     if ($Settings.remediate -eq $true) {
         Write-Host "Settings: $($Settings.TemplateList | ConvertTo-Json)"
         foreach ($Template in $AssignmentFilterTemplates) {
@@ -115,12 +124,6 @@ function Invoke-CIPPStandardAssignmentFilterTemplate {
             }
         }
 
-        if ($MissingFilters.Count -eq 0) {
-            $fieldValue = $true
-        } else {
-            $fieldValue = $MissingFilters -join ', '
-        }
-
-        Set-CIPPStandardsCompareField -FieldName 'standards.AssignmentFilterTemplate' -FieldValue $fieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AssignmentFilterTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
index 4eb08c0cf3fa..3bf5fd8ba0d7 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
@@ -51,6 +51,13 @@ function Invoke-CIPPStandardAtpPolicyForO365 {
     ($CurrentState.EnableSafeDocs -eq $true) -and
     ($CurrentState.AllowSafeDocsOpen -eq $Settings.AllowSafeDocsOpen)
 
+    $CurrentValue = $CurrentState | Select-Object EnableATPForSPOTeamsODB, EnableSafeDocs, AllowSafeDocsOpen
+    $ExpectedValue = [PSCustomObject]@{
+        EnableATPForSPOTeamsODB = $true
+        EnableSafeDocs          = $true
+        AllowSafeDocsOpen       = $Settings.AllowSafeDocsOpen
+    }
+
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Atp Policy For O365 already set.' -sev Info
@@ -83,7 +90,7 @@ function Invoke-CIPPStandardAtpPolicyForO365 {
 
     if ($Settings.report -eq $true) {
         $state = $StateIsCorrect -eq $true ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.AtpPolicyForO365' -FieldValue $state -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AtpPolicyForO365' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'AtpPolicyForO365' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
index 3d8ef1325f2e..4d1c5a4d1b68 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
@@ -46,6 +46,13 @@ function Invoke-CIPPStandardAuditLog {
     Write-Host ($Settings | ConvertTo-Json)
     $AuditLogEnabled = [bool](New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AdminAuditLogConfig' -Select UnifiedAuditLogIngestionEnabled).UnifiedAuditLogIngestionEnabled
 
+    $CurrentValue = [PSCustomObject]@{
+        UnifiedAuditLogIngestionEnabled = $AuditLogEnabled
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        UnifiedAuditLogIngestionEnabled = $true
+    }
+
     if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
@@ -85,7 +92,7 @@ function Invoke-CIPPStandardAuditLog {
 
     if ($Settings.report -eq $true) {
         $state = $AuditLogEnabled -eq $true ? $true : $AuditLogEnabled
-        Set-CIPPStandardsCompareField -FieldName 'standards.AuditLog' -FieldValue $state -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AuditLog' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AuditLog' -FieldValue $AuditLogEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1
index 733571d2ceba..cd3f5126a43d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1
@@ -43,6 +43,11 @@ function Invoke-CIPPStandardAuthMethodsPolicyMigration {
         throw 'Failed to retrieve current authentication methods policy information'
     }
 
+    $CurrentValue = $CurrentInfo | Select-Object policyMigrationState
+    $ExpectedValue = [PSCustomObject]@{
+        policyMigrationState = 'migrationComplete'
+    }
+
     if ($Settings.remediate -eq $true) {
         if ($CurrentInfo.policyMigrationState -eq 'migrationComplete' -or $null -eq $CurrentInfo.policyMigrationState) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Authentication methods policy migration is already complete.' -sev Info
@@ -66,7 +71,7 @@ function Invoke-CIPPStandardAuthMethodsPolicyMigration {
 
     if ($Settings.report -eq $true) {
         $migrationComplete = $CurrentInfo.policyMigrationState -eq 'migrationComplete' -or $null -eq $CurrentInfo.policyMigrationState
-        Set-CIPPStandardsCompareField -FieldName 'standards.AuthMethodsPolicyMigration' -FieldValue $migrationComplete -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AuthMethodsPolicyMigration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'AuthMethodsPolicyMigration' -FieldValue $migrationComplete -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1
index da292eff3ae1..cd0332008211 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1
@@ -36,7 +36,6 @@ function Invoke-CIPPStandardAuthMethodsSettings {
 
     param($Tenant, $Settings)
 
-    Write-Host 'Time to run'
     # Get current authentication methods policy
     try {
         $CurrentPolicy = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy' -tenantid $Tenant -AsApp $true
@@ -61,7 +60,14 @@ function Invoke-CIPPStandardAuthMethodsSettings {
         return
     }
 
-
+    $CurrentValue = [PSCustomObject]@{
+        reportSuspiciousActivitySettings = $CurrentPolicy.reportSuspiciousActivitySettings.state
+        systemCredentialPreferences      = $CurrentPolicy.systemCredentialPreferences.state
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        reportSuspiciousActivitySettings = $ReportSuspiciousActivityState
+        systemCredentialPreferences      = $SystemCredentialState
+    }
 
     # Check if states are set correctly
     $ReportSuspiciousActivityCorrect = if ($CurrentPolicy.reportSuspiciousActivitySettings.state -eq $ReportSuspiciousActivityState) { $true } else { $false }
@@ -93,8 +99,7 @@ function Invoke-CIPPStandardAuthMethodsSettings {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateSetCorrectly ? $true :  @{CurrentReportState = $CurrentReportState; CurrentSystemState = $CurrentSystemState; WantedReportState = $ReportSuspiciousActivityState; WantedSystemState = $SystemCredentialState }
-        Set-CIPPStandardsCompareField -FieldName 'standards.AuthMethodsSettings' -FieldValue $state -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AuthMethodsSettings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'ReportSuspiciousActivity' -FieldValue $CurrentPolicy.reportSuspiciousActivitySettings.state -StoreAs string -Tenant $tenant
         Add-CIPPBPAField -FieldName 'SystemCredential' -FieldValue $CurrentPolicy.systemCredentialPreferences.state -StoreAs string -Tenant $tenant
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1
index 06313eebbf53..43b3a943ecf3 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1
@@ -56,10 +56,16 @@ function Invoke-CIPPStandardAutoAddProxy {
     }
 
     $StateIsCorrect = $MissingProxies -eq 0
+    $ExpectedValue = [PSCustomObject]@{
+        MissingProxies = 0
+    }
+    $CurrentValue = [PSCustomObject]@{
+        MissingProxies = $MissingProxies
+    }
+
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : $MissingProxies
-        Set-CIPPStandardsCompareField -FieldName 'standards.AutoAddProxy' -FieldValue $state -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AutoAddProxy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AutoAddProxy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1
index c11d2f661262..971c4bf55e56 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1
@@ -57,6 +57,13 @@ function Invoke-CIPPStandardAutoArchive {
 
     $CorrectState = $CurrentState -eq $DesiredThreshold
 
+    $ExpectedValue = [PSCustomObject]@{
+        AutoArchivingThresholdPercentage = $DesiredThreshold
+    }
+    $CurrentValue = [PSCustomObject]@{
+        AutoArchivingThresholdPercentage = $CurrentState
+    }
+
     if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
@@ -91,6 +98,6 @@ function Invoke-CIPPStandardAutoArchive {
         } else {
             $FieldValue = @{ CurrentThreshold = $CurrentState; DesiredThreshold = $DesiredThreshold }
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.AutoArchive' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AutoArchive' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
index 6a9f9d80cc8d..72b4552da9bb 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
@@ -46,6 +46,13 @@ function Invoke-CIPPStandardAutoExpandArchive {
         return
     }
 
+    $ExpectedValue = [PSCustomObject]@{
+        AutoExpandingArchive = $true
+    }
+    $CurrentValue = [PSCustomObject]@{
+        AutoExpandingArchive = $CurrentState
+    }
+
     if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
@@ -73,8 +80,7 @@ function Invoke-CIPPStandardAutoExpandArchive {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $CurrentState -eq $true ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.AutoExpandArchive' -FieldValue $state -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AutoExpandArchive' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'AutoExpandingArchive' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1
index 4db07c9b94b8..98cda9ca282b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1
@@ -78,6 +78,32 @@ function Invoke-CIPPStandardAutopilotProfile {
         $StateIsCorrect = $false
     }
 
+    $CurrentValue = $CurrentConfig | Select-Object -Property displayName, description, deviceNameTemplate, locale, preprovisioningAllowed, hardwareHashExtractionEnabled, @{Name = 'outOfBoxExperienceSetting'; Expression = {
+            [PSCustomObject]@{
+                deviceUsageType              = $_.outOfBoxExperienceSetting.deviceUsageType
+                privacySettingsHidden        = $_.outOfBoxExperienceSetting.privacySettingsHidden
+                eulaHidden                   = $_.outOfBoxExperienceSetting.eulaHidden
+                userType                     = $_.outOfBoxExperienceSetting.userType
+                keyboardSelectionPageSkipped = $_.outOfBoxExperienceSetting.keyboardSelectionPageSkipped
+            }
+        }
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        displayName                   = $Settings.DisplayName
+        description                   = $Settings.Description
+        deviceNameTemplate            = $Settings.DeviceNameTemplate
+        locale                        = $Settings.Languages.value
+        preprovisioningAllowed        = $Settings.AllowWhiteGlove
+        hardwareHashExtractionEnabled = $Settings.CollectHash
+        outOfBoxExperienceSetting     = [PSCustomObject]@{
+            deviceUsageType              = $DeploymentMode
+            privacySettingsHidden        = $Settings.HidePrivacy
+            eulaHidden                   = $Settings.HideTerms
+            userType                     = $userType
+            keyboardSelectionPageSkipped = $Settings.AutoKeyboard
+        }
+    }
+
     # Remediate if the state is not correct
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
@@ -117,8 +143,7 @@ function Invoke-CIPPStandardAutopilotProfile {
 
     # Report
     if ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect -eq $true ? $true : $CurrentConfig
-        Set-CIPPStandardsCompareField -FieldName 'standards.AutopilotProfile' -FieldValue $FieldValue -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AutopilotProfile' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AutopilotProfile' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1
index e765ec90013e..17ac191280b5 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1
@@ -68,6 +68,19 @@ function Invoke-CIPPStandardAutopilotStatusPage {
         $StateIsCorrect = $false
     }
 
+    $CurrentValue = $CurrentConfig | Select-Object -Property id, displayName, priority, showInstallationProgress, blockDeviceSetupRetryByUser, allowDeviceResetOnInstallFailure, allowLogCollectionOnInstallFailure, customErrorMessage, installProgressTimeoutInMinutes, allowDeviceUseOnInstallFailure, trackInstallProgressForAutopilotOnly, installQualityUpdates
+    $ExpectedValue = [PSCustomObject]@{
+        installProgressTimeoutInMinutes      = $Settings.TimeOutInMinutes
+        customErrorMessage                   = $Settings.ErrorMessage
+        showInstallationProgress             = $Settings.ShowProgress
+        allowLogCollectionOnInstallFailure   = $Settings.EnableLog
+        trackInstallProgressForAutopilotOnly = $Settings.OBEEOnly
+        blockDeviceSetupRetryByUser          = !$Settings.BlockDevice
+        installQualityUpdates                = $InstallWindowsUpdates
+        allowDeviceResetOnInstallFailure     = $Settings.AllowReset
+        allowDeviceUseOnInstallFailure       = $Settings.AllowFail
+    }
+
     # Remediate if the state is not correct
     if ($Settings.remediate -eq $true) {
         try {
@@ -91,8 +104,7 @@ function Invoke-CIPPStandardAutopilotStatusPage {
 
     # Report
     if ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect -eq $true ? $true : $CurrentConfig
-        Set-CIPPStandardsCompareField -FieldName 'standards.AutopilotStatusPage' -FieldValue $FieldValue -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.AutopilotStatusPage' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AutopilotStatusPage' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1
index e063f6a05f9e..ffd3062882a1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1
@@ -55,8 +55,15 @@ function Invoke-CIPPStandardBitLockerKeysForOwnedDevice {
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the BitLockerKeysForOwnedDevice state for $Tenant. Error: $($ErrorMessage.NormalizedError)" -Sev Error -LogData $ErrorMessage
         return
     }
-    $CurrentValue = [bool]$CurrentState.defaultUserRolePermissions.allowedToReadBitLockerKeysForOwnedDevice
-    $StateIsCorrect = ($CurrentValue -eq $DesiredValue)
+    $CurrentStateValue = [bool]$CurrentState.defaultUserRolePermissions.allowedToReadBitLockerKeysForOwnedDevice
+    $StateIsCorrect = ($CurrentStateValue -eq $DesiredValue)
+
+    $CurrentValue = [PSCustomObject]@{
+        allowedToReadBitLockerKeysForOwnedDevice = $CurrentStateValue
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        allowedToReadBitLockerKeysForOwnedDevice = $DesiredValue
+    }
 
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
@@ -72,7 +79,7 @@ function Invoke-CIPPStandardBitLockerKeysForOwnedDevice {
 
                 # Update current state variables to reflect the change immediately if running remediate and report/alert together
                 $CurrentState.defaultUserRolePermissions.allowedToReadBitLockerKeysForOwnedDevice = $DesiredValue
-                $CurrentValue = $DesiredValue
+                $CurrentStateValue = $DesiredValue
                 $StateIsCorrect = $true
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
@@ -85,7 +92,7 @@ function Invoke-CIPPStandardBitLockerKeysForOwnedDevice {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message "Users are $DesiredLabel to recover BitLocker keys for their owned devices as configured." -sev Info
         } else {
-            $CurrentLabel = if ($CurrentValue) { 'allowed' } else { 'restricted' }
+            $CurrentLabel = if ($CurrentStateValue) { 'allowed' } else { 'restricted' }
             $AlertMessage = "Users are $CurrentLabel to recover BitLocker keys for their owned devices but should be $DesiredLabel."
             Write-StandardsAlert -message $AlertMessage -object $CurrentState -tenant $tenant -standardName 'BitLockerKeysForOwnedDevice' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -tenant $tenant -message $AlertMessage -sev Info
@@ -93,7 +100,7 @@ function Invoke-CIPPStandardBitLockerKeysForOwnedDevice {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.BitLockerKeysForOwnedDevice' -FieldValue $StateIsCorrect -Tenant $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.BitLockerKeysForOwnedDevice' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
         Add-CIPPBPAField -FieldName 'BitLockerKeysForOwnedDevice' -FieldValue $CurrentValue -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
index a9d2d9633ffe..608aadf0e58c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBookings.ps1
@@ -52,9 +52,16 @@ function Invoke-CIPPStandardBookings {
     $WantedState = if ($state -eq 'true') { $true } else { $false }
     $StateIsCorrect = if ($CurrentState -eq $WantedState) { $true } else { $false }
 
+    $CurrentValue = [PSCustomObject]@{
+        BookingsEnabled = $CurrentState
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        BookingsEnabled = $WantedState
+    }
+
     if ($Settings.report -eq $true) {
         $state = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.Bookings' -FieldValue $state -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.Bookings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         if ($null -eq $CurrentState ) { $CurrentState = $true }
         Add-CIPPBPAField -FieldName 'BookingsState' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1
index c6b8f80a97a6..467279f5838d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardBranding.ps1
@@ -88,6 +88,25 @@ function Invoke-CIPPStandardBranding {
     ($CurrentState.loginPageLayoutConfiguration.isHeaderShown -eq $Settings.isHeaderShown) -and
     ($CurrentState.loginPageLayoutConfiguration.isFooterShown -eq $Settings.isFooterShown)
 
+    $CurrentValue = [PSCustomObject]@{
+        signInPageText                  = $CurrentState.signInPageText
+        usernameHintText                = $CurrentState.usernameHintText
+        loginPageTextVisibilitySettings = $CurrentState.loginPageTextVisibilitySettings | Select-Object -Property hideAccountResetCredentials
+        loginPageLayoutConfiguration    = $CurrentState.loginPageLayoutConfiguration | Select-Object -Property layoutTemplateType, isHeaderShown, isFooterShown
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        signInPageText                  = $Settings.signInPageText
+        usernameHintText                = $Settings.usernameHintText
+        loginPageTextVisibilitySettings = [pscustomobject]@{
+            hideAccountResetCredentials = $Settings.hideAccountResetCredentials
+        }
+        loginPageLayoutConfiguration    = [pscustomobject]@{
+            layoutTemplateType = $layoutTemplateType
+            isHeaderShown      = $Settings.isHeaderShown
+            isFooterShown      = $Settings.isFooterShown
+        }
+    }
+
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Branding is already applied correctly.' -Sev Info
@@ -133,8 +152,7 @@ function Invoke-CIPPStandardBranding {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect -eq $true ? $true : ($CurrentState | Select-Object -Property signInPageText, usernameHintText, loginPageTextVisibilitySettings, loginPageLayoutConfiguration)
-        Set-CIPPStandardsCompareField -FieldName 'standards.Branding' -FieldValue $state -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.Branding' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'Branding' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
index 8a61d794eac0..48feb07b2c45 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
@@ -52,18 +52,26 @@ function Invoke-CIPPStandardCloudMessageRecall {
     $WantedState = if ($state -eq 'true') { $true } else { $false }
     $StateIsCorrect = if ($CurrentState -eq $WantedState) { $true } else { $false }
 
+    # Input validation
+    if (([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
+        Write-LogMessage -API 'Standards' -tenant $Tenant -message 'CloudMessageRecall: Invalid state parameter set' -sev Error
+        return
+    }
+
+    $CurrentValue = [PSCustomObject]@{
+        MessageRecallEnabled = $CurrentState
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        MessageRecallEnabled = $WantedState
+    }
+
     if ($Settings.report -eq $true) {
         # Default is not set, not set means it's enabled
         if ($null -eq $CurrentState ) { $CurrentState = $true }
-        Set-CIPPStandardsCompareField -FieldName 'standards.CloudMessageRecall' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.CloudMessageRecall' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'MessageRecall' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 
-    # Input validation
-    if (([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
-        Write-LogMessage -API 'Standards' -tenant $Tenant -message 'CloudMessageRecall: Invalid state parameter set' -sev Error
-        return
-    }
 
     if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1
index 151b30a27999..acdb5f3757f6 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1
@@ -105,8 +105,15 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
                     Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Policy $($Setting.label) is missing from this tenant." -Tenant $Tenant
                 }
             } else {
-                $CompareObj = ConvertFrom-Json -ErrorAction SilentlyContinue -InputObject (New-CIPPCATemplate -TenantFilter $tenant -JSON $CheckExististing)
-                $Compare = Compare-CIPPIntuneObject -ReferenceObject $policy -DifferenceObject $CompareObj
+                $templateResult = New-CIPPCATemplate -TenantFilter $tenant -JSON $CheckExististing
+                $CompareObj = ConvertFrom-Json -ErrorAction SilentlyContinue -InputObject $templateResult
+                try {
+                    $Compare = Compare-CIPPIntuneObject -ReferenceObject $policy -DifferenceObject $CompareObj
+                } catch {
+                    Write-LogMessage -API 'Standards' -tenant $Tenant -message "Error comparing CA policy: $($_.Exception.Message)" -sev Error
+                    Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue "Error comparing policy: $($_.Exception.Message)" -Tenant $Tenant
+                    continue
+                }
                 if (!$Compare) {
                     Set-CIPPStandardsCompareField -FieldName "standards.ConditionalAccessTemplate.$($Setting.value)" -FieldValue $true -Tenant $Tenant
                 } else {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1
index 6c5009d324a9..1eb6f3370fcd 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1
@@ -203,6 +203,14 @@ function Invoke-CIPPStandardCustomBannedPasswordList {
     }
 
     if ($Settings.report -eq $true) {
+        $ExpectedValue = @{
+            Status            = 'Configured'
+            Enabled           = $true
+            WordCount         = $BannedWordsList.Count
+            Compliant         = $true
+            MissingInputWords = @()
+        }
+
         if ($null -eq $ExistingSettings) {
             $BannedPasswordState = @{
                 Status            = 'Not Configured'
@@ -229,7 +237,7 @@ function Invoke-CIPPStandardCustomBannedPasswordList {
             }
         }
 
-        Add-CIPPBPAField -FieldName 'CustomBannedPasswordList' -FieldValue $BannedPasswordState -StoreAs json -Tenant $tenant
+        Add-CIPPBPAField -FieldName 'CustomBannedPasswordList' -CurrentValue $BannedPasswordState -ExpectedValue $ExpectedValue -StoreAs json -Tenant $tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.CustomBannedPasswordList' -FieldValue $BannedPasswordState.Compliant -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1
index 1dc00ce739d0..23945c2b628b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1
@@ -50,72 +50,84 @@ function Invoke-CIPPStandardDefaultPlatformRestrictions {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?`$expand=assignments&orderBy=priority&`$filter=deviceEnrollmentConfigurationType eq 'SinglePlatformRestriction'" -tenantID $Tenant -AsApp $true |
-        Select-Object -Property id, androidForWorkRestriction, androidRestriction, iosRestriction, macOSRestriction, windowsRestriction
-    }
-    catch {
+            Select-Object -Property id, androidForWorkRestriction, androidRestriction, iosRestriction, macOSRestriction, windowsRestriction
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DefaultPlatformRestrictions state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
     $StateIsCorrect = ($CurrentState.androidForWorkRestriction.platformBlocked -eq $Settings.platformAndroidForWorkBlocked) -and
-        ($CurrentState.androidForWorkRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalAndroidForWorkBlocked) -and
-        ($CurrentState.androidRestriction.platformBlocked -eq $Settings.platformAndroidBlocked) -and
-        ($CurrentState.androidRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalAndroidBlocked) -and
-        ($CurrentState.iosRestriction.platformBlocked -eq $Settings.platformiOSBlocked) -and
-        ($CurrentState.iosRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personaliOSBlocked) -and
-        ($CurrentState.macOSRestriction.platformBlocked -eq $Settings.platformMacOSBlocked) -and
-        ($CurrentState.macOSRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalMacOSBlocked) -and
-        ($CurrentState.windowsRestriction.platformBlocked -eq $Settings.platformWindowsBlocked) -and
-        ($CurrentState.windowsRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalWindowsBlocked)
+    ($CurrentState.androidForWorkRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalAndroidForWorkBlocked) -and
+    ($CurrentState.androidRestriction.platformBlocked -eq $Settings.platformAndroidBlocked) -and
+    ($CurrentState.androidRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalAndroidBlocked) -and
+    ($CurrentState.iosRestriction.platformBlocked -eq $Settings.platformiOSBlocked) -and
+    ($CurrentState.iosRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personaliOSBlocked) -and
+    ($CurrentState.macOSRestriction.platformBlocked -eq $Settings.platformMacOSBlocked) -and
+    ($CurrentState.macOSRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalMacOSBlocked) -and
+    ($CurrentState.windowsRestriction.platformBlocked -eq $Settings.platformWindowsBlocked) -and
+    ($CurrentState.windowsRestriction.personalDeviceEnrollmentBlocked -eq $Settings.personalWindowsBlocked)
 
     $CompareField = [PSCustomObject]@{
-        platformAndroidForWorkBlocked   = $CurrentState.androidForWorkRestriction.platformBlocked
-        personalAndroidForWorkBlocked   = $CurrentState.androidForWorkRestriction.personalDeviceEnrollmentBlocked
-        platformAndroidBlocked          = $CurrentState.androidRestriction.platformBlocked
-        personalAndroidBlocked          = $CurrentState.androidRestriction.personalDeviceEnrollmentBlocked
-        platformiOSBlocked              = $CurrentState.iosRestriction.platformBlocked
-        personaliOSBlocked              = $CurrentState.iosRestriction.personalDeviceEnrollmentBlocked
-        platformMacOSBlocked            = $CurrentState.macOSRestriction.platformBlocked
-        personalMacOSBlocked            = $CurrentState.macOSRestriction.personalDeviceEnrollmentBlocked
-        platformWindowsBlocked          = $CurrentState.windowsRestriction.platformBlocked
-        personalWindowsBlocked          = $CurrentState.windowsRestriction.personalDeviceEnrollmentBlocked
+        platformAndroidForWorkBlocked = $CurrentState.androidForWorkRestriction.platformBlocked
+        personalAndroidForWorkBlocked = $CurrentState.androidForWorkRestriction.personalDeviceEnrollmentBlocked
+        platformAndroidBlocked        = $CurrentState.androidRestriction.platformBlocked
+        personalAndroidBlocked        = $CurrentState.androidRestriction.personalDeviceEnrollmentBlocked
+        platformiOSBlocked            = $CurrentState.iosRestriction.platformBlocked
+        personaliOSBlocked            = $CurrentState.iosRestriction.personalDeviceEnrollmentBlocked
+        platformMacOSBlocked          = $CurrentState.macOSRestriction.platformBlocked
+        personalMacOSBlocked          = $CurrentState.macOSRestriction.personalDeviceEnrollmentBlocked
+        platformWindowsBlocked        = $CurrentState.windowsRestriction.platformBlocked
+        personalWindowsBlocked        = $CurrentState.windowsRestriction.personalDeviceEnrollmentBlocked
+    }
+
+    $ExpectedValue = [PSCustomObject]@{
+        platformAndroidForWorkBlocked = $Settings.platformAndroidForWorkBlocked
+        personalAndroidForWorkBlocked = $Settings.personalAndroidForWorkBlocked
+        platformAndroidBlocked        = $Settings.platformAndroidBlocked
+        personalAndroidBlocked        = $Settings.personalAndroidBlocked
+        platformiOSBlocked            = $Settings.platformiOSBlocked
+        personaliOSBlocked            = $Settings.personaliOSBlocked
+        platformMacOSBlocked          = $Settings.platformMacOSBlocked
+        personalMacOSBlocked          = $Settings.personalMacOSBlocked
+        platformWindowsBlocked        = $Settings.platformWindowsBlocked
+        personalWindowsBlocked        = $Settings.personalWindowsBlocked
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'DefaultPlatformRestrictions is already applied correctly.' -Sev Info
         } else {
             $cmdParam = @{
-                tenantid  = $Tenant
-                uri      = "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations/$($CurrentState.id)"
-                AsApp    = $false
-                Type     = 'PATCH'
+                tenantid    = $Tenant
+                uri         = "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations/$($CurrentState.id)"
+                AsApp       = $false
+                Type        = 'PATCH'
                 ContentType = 'application/json; charset=utf-8'
-                Body     = [PSCustomObject]@{
-                    "@odata.type" = "#microsoft.graph.deviceEnrollmentPlatformRestrictionsConfiguration"
+                Body        = [PSCustomObject]@{
+                    '@odata.type'             = '#microsoft.graph.deviceEnrollmentPlatformRestrictionsConfiguration'
                     androidForWorkRestriction = [PSCustomObject]@{
-                        "@odata.type"                   = "microsoft.graph.deviceEnrollmentPlatformRestriction"
+                        '@odata.type'                   = 'microsoft.graph.deviceEnrollmentPlatformRestriction'
                         platformBlocked                 = $Settings.platformAndroidForWorkBlocked
                         personalDeviceEnrollmentBlocked = $Settings.personalAndroidForWorkBlocked
                     }
-                    androidRestriction = [PSCustomObject]@{
-                        "@odata.type"                   = "microsoft.graph.deviceEnrollmentPlatformRestriction"
+                    androidRestriction        = [PSCustomObject]@{
+                        '@odata.type'                   = 'microsoft.graph.deviceEnrollmentPlatformRestriction'
                         platformBlocked                 = $Settings.platformAndroidBlocked
                         personalDeviceEnrollmentBlocked = $Settings.personalAndroidBlocked
                     }
-                    iosRestriction = [PSCustomObject]@{
-                        "@odata.type"                   = "microsoft.graph.deviceEnrollmentPlatformRestriction"
+                    iosRestriction            = [PSCustomObject]@{
+                        '@odata.type'                   = 'microsoft.graph.deviceEnrollmentPlatformRestriction'
                         platformBlocked                 = $Settings.platformiOSBlocked
                         personalDeviceEnrollmentBlocked = $Settings.personaliOSBlocked
                     }
-                    macOSRestriction = [PSCustomObject]@{
-                        "@odata.type"                   = "microsoft.graph.deviceEnrollmentPlatformRestriction"
+                    macOSRestriction          = [PSCustomObject]@{
+                        '@odata.type'                   = 'microsoft.graph.deviceEnrollmentPlatformRestriction'
                         platformBlocked                 = $Settings.platformMacOSBlocked
                         personalDeviceEnrollmentBlocked = $Settings.personalMacOSBlocked
                     }
-                    windowsRestriction = [PSCustomObject]@{
-                        "@odata.type"                   = "microsoft.graph.deviceEnrollmentPlatformRestriction"
+                    windowsRestriction        = [PSCustomObject]@{
+                        '@odata.type'                   = 'microsoft.graph.deviceEnrollmentPlatformRestriction'
                         platformBlocked                 = $Settings.platformWindowsBlocked
                         personalDeviceEnrollmentBlocked = $Settings.personalWindowsBlocked
                     }
@@ -132,7 +144,7 @@ function Invoke-CIPPStandardDefaultPlatformRestrictions {
 
     }
 
-    If ($Settings.alert -eq $true) {
+    if ($Settings.alert -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'DefaultPlatformRestrictions is correctly set.' -Sev Info
         } else {
@@ -141,9 +153,8 @@ function Invoke-CIPPStandardDefaultPlatformRestrictions {
         }
     }
 
-    If ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : $CompareField
-        Set-CIPPStandardsCompareField -FieldName 'standards.DefaultPlatformRestrictions' -FieldValue $FieldValue -TenantFilter $Tenant
+    if ($Settings.report -eq $true) {
+        Set-CIPPStandardsCompareField -FieldName 'standards.DefaultPlatformRestrictions' -CurrentValue $CompareField -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DefaultPlatformRestrictions' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1
index 409ad97db6bb..d3397e85af50 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1
@@ -36,7 +36,7 @@ function Invoke-CIPPStandardDefaultSharingLink {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'DefaultSharingLink' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'DefaultSharingLink' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     # Determine the desired sharing link type (default to Internal if not specified)
 
@@ -56,14 +56,32 @@ function Invoke-CIPPStandardDefaultSharingLink {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object -Property _ObjectIdentity_, TenantFilter, DefaultSharingLinkType, DefaultLinkPermission
-    }
-    catch {
+            Select-Object -Property _ObjectIdentity_, TenantFilter, DefaultSharingLinkType, DefaultLinkPermission
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DefaultSharingLink state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
+    $CurrentValue = [PSCustomObject]@{
+        DefaultSharingLinkType = switch ($CurrentState.DefaultSharingLinkType) {
+            1 { 'Direct' }
+            2 { 'Internal' }
+            3 { 'Anyone' }
+            default { 'Unknown' }
+        }
+        DefaultLinkPermission  = switch ($CurrentState.DefaultLinkPermission) {
+            0 { 'Edit' }
+            1 { 'View' }
+            2 { 'Edit' }
+            default { 'Unknown' }
+        }
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        DefaultSharingLinkType = $DesiredSharingLinkType
+        DefaultLinkPermission  = 'View'
+    }
+
     # Check if the current state matches the desired configuration
     $StateIsCorrect = ($CurrentState.DefaultSharingLinkType -eq $DesiredSharingLinkTypeValue) -and ($CurrentState.DefaultLinkPermission -eq 1)
     Write-Host "currentstate: $($CurrentState.DefaultSharingLinkType), $($CurrentState.DefaultLinkPermission). Desired: $DesiredSharingLinkTypeValue, 1"
@@ -117,6 +135,6 @@ function Invoke-CIPPStandardDefaultSharingLink {
         } else {
             $FieldValue = $CurrentState
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DefaultSharingLink' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.DefaultSharingLink' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
index 14c3d735e600..ac95dcd2b1fd 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
@@ -47,15 +47,23 @@ function Invoke-CIPPStandardDelegateSentItems {
 
     if ($Settings.IncludeUserMailboxes -eq $true) {
         $Mailboxes = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ RecipientTypeDetails = @('UserMailbox', 'SharedMailbox') } -Select 'Identity,UserPrincipalName,MessageCopyForSendOnBehalfEnabled,MessageCopyForSentAsEnabled' |
-        Where-Object { $_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false }
+            Where-Object { $_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false }
     } else {
         $Mailboxes = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ RecipientTypeDetails = @('SharedMailbox') } -Select 'Identity,UserPrincipalName,MessageCopyForSendOnBehalfEnabled,MessageCopyForSentAsEnabled' |
-        Where-Object { $_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false }
+            Where-Object { $_.MessageCopyForSendOnBehalfEnabled -eq $false -or $_.MessageCopyForSentAsEnabled -eq $false }
     }
 
+    $CurrentValue = if (!$Mailboxes) {
+        [PSCustomObject]@{ state = 'Configured correctly' }
+    } else {
+        [PSCustomObject]@{ NonCompliantMailboxes = $Mailboxes | Select-Object -Property UserPrincipalName, MessageCopyForSendOnBehalfEnabled, MessageCopyForSentAsEnabled }
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        state = 'Configured correctly'
+    }
 
     Write-Host "Mailboxes: $($Mailboxes.Count)"
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
         if ($Mailboxes) {
@@ -97,8 +105,7 @@ function Invoke-CIPPStandardDelegateSentItems {
 
     if ($Settings.report -eq $true) {
         $Filtered = $Mailboxes | Select-Object -Property UserPrincipalName, MessageCopyForSendOnBehalfEnabled, MessageCopyForSentAsEnabled
-        $CurrentState = if ($null -eq $Mailboxes) { $true } else { $Filtered }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DelegateSentItems' -FieldValue $CurrentState -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.DelegateSentItems' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DelegateSentItems' -FieldValue $Filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
index 41172643c22e..ccb08c900fe3 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
@@ -31,7 +31,7 @@ function Invoke-CIPPStandardDeletedUserRentention {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'DeletedUserRentention' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'DeletedUserRentention' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
     ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DeletedUserRetention'
 
     if ($TestResult -eq $false) {
@@ -41,17 +41,22 @@ function Invoke-CIPPStandardDeletedUserRentention {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DeletedUserRetention state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $Days = $Settings.Days.value ?? $Settings.Days
 
+    $ExpectedValue = [PSCustomObject]@{
+        DeletedUserRententionDays = [int]$Days
+    }
+    $CurrentValue = [PSCustomObject]@{
+        DeletedUserRententionDays = $CurrentInfo.deletedUserPersonalSiteRetentionPeriodInDays
+    }
+
     if ($Settings.report -eq $true) {
-        $CurrentState = $CurrentInfo.deletedUserPersonalSiteRetentionPeriodInDays -eq $Days ? $true : ($CurrentInfo | Select-Object deletedUserPersonalSiteRetentionPeriodInDays)
-        Set-CIPPStandardsCompareField -FieldName 'standards.DeletedUserRentention' -FieldValue $CurrentState -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.DeletedUserRentention' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DeletedUserRentention' -FieldValue $CurrentInfo.deletedUserPersonalSiteRetentionPeriodInDays -StoreAs string -Tenant $Tenant
     }
 
@@ -60,7 +65,7 @@ function Invoke-CIPPStandardDeletedUserRentention {
     # Input validation
     if (($Days -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message 'DeletedUserRentention: Invalid Days parameter set' -sev Error
-        Return
+        return
     }
 
     # Backwards compatibility for v5.9.4 and back
@@ -72,7 +77,7 @@ function Invoke-CIPPStandardDeletedUserRentention {
 
     $StateSetCorrectly = if ($CurrentInfo.deletedUserPersonalSiteRetentionPeriodInDays -eq $WantedState) { $true } else { $false }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
         if ($StateSetCorrectly -eq $false) {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1
index 664e27fec20c..921fe6d5db0f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1
@@ -65,13 +65,18 @@ function Invoke-CIPPStandardDeployCheckChromeExtension {
     $ChromePolicyName = 'Deploy Check Chrome Extension (Chrome)'
     $EdgePolicyName = 'Deploy Check Chrome Extension (Edge)'
 
+    # CIPP Url
+    $CippConfigTable = Get-CippTable -tablename Config
+    $CippConfig = Get-CIPPAzDataTableEntity @CippConfigTable -Filter "PartitionKey eq 'InstanceProperties' and RowKey eq 'CIPPURL'"
+    $CIPPURL = 'https://{0}' -f $CippConfig.Value
+
     # Get configuration values with defaults
     $ShowNotifications = $Settings.showNotifications ?? $true
     $EnableValidPageBadge = $Settings.enableValidPageBadge ?? $true
     $EnablePageBlocking = $Settings.enablePageBlocking ?? $true
     $EnableCippReporting = $Settings.enableCippReporting ?? $true
-    $CippServerUrl = $Settings.cippServerUrl
-    $CippTenantId = $Settings.cippTenantId
+    $CippServerUrl = $CIPPURL
+    $CippTenantId = $Tenant
     $CustomRulesUrl = $Settings.customRulesUrl
     $UpdateInterval = $Settings.updateInterval ?? 24
     $EnableDebugLogging = $Settings.enableDebugLogging ?? $false
@@ -212,7 +217,16 @@ function Invoke-CIPPStandardDeployCheckChromeExtension {
 
         if ($Settings.report -eq $true) {
             $StateIsCorrect = $ChromePolicyExists -and $EdgePolicyExists
-            Set-CIPPStandardsCompareField -FieldName 'standards.DeployCheckChromeExtension' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+
+            $ExpectedValue = [PSCustomObject]@{
+                ChromePolicyDeployed = $true
+                EdgePolicyDeployed   = $true
+            }
+            $CurrentValue = [PSCustomObject]@{
+                ChromePolicyDeployed = $ChromePolicyExists
+                EdgePolicyDeployed   = $EdgePolicyExists
+            }
+            Set-CIPPStandardsCompareField -FieldName 'standards.DeployCheckChromeExtension' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
             Add-CIPPBPAField -FieldName 'DeployCheckChromeExtension' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
         }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1
index c5a6ce29d1f6..067feb5c567d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1
@@ -58,8 +58,7 @@ function Invoke-CIPPStandardDeployContactTemplates {
             }
 
             return $StoredTemplate.JSON | ConvertFrom-Json
-        }
-        catch {
+        } catch {
             Write-LogMessage -API $APIName -tenant $Tenant -message "Failed to retrieve template $TemplateGUID. Error: $($_.Exception.Message)" -sev Error
             return $null
         }
@@ -75,8 +74,8 @@ function Invoke-CIPPStandardDeployContactTemplates {
 
         # Get templateIds array
         if (-not $Settings.templateIds -or $Settings.templateIds.Count -eq 0) {
-            Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: No template IDs found in settings" -sev Error
-            return "No template IDs found in settings"
+            Write-LogMessage -API $APIName -tenant $Tenant -message 'DeployContactTemplate: No template IDs found in settings' -sev Error
+            return 'No template IDs found in settings'
         }
 
         Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: Processing $($Settings.templateIds.Count) template(s)" -sev Info
@@ -91,7 +90,7 @@ function Invoke-CIPPStandardDeployContactTemplates {
                 $TemplateGUID = $TemplateItem.value
 
                 if ([string]::IsNullOrWhiteSpace($TemplateGUID)) {
-                    Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: TemplateGUID cannot be empty." -sev Error
+                    Write-LogMessage -API $APIName -tenant $Tenant -message 'DeployContactTemplate: TemplateGUID cannot be empty.' -sev Error
                     continue
                 }
 
@@ -115,8 +114,7 @@ function Invoke-CIPPStandardDeployContactTemplates {
                 # Validate email address format
                 try {
                     $null = [System.Net.Mail.MailAddress]::new($Template.email)
-                }
-                catch {
+                } catch {
                     Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: Invalid email address format: $($Template.email)" -sev Error
                     continue
                 }
@@ -127,39 +125,37 @@ function Invoke-CIPPStandardDeployContactTemplates {
                 # If the contact exists, we'll overwrite it; if not, we'll create it
                 if ($ExistingContact) {
                     $StateIsCorrect = $false  # Always update existing contacts to match template
-                    $Action = "Update"
+                    $Action = 'Update'
                     $Missing = $false
-                }
-                else {
+                } else {
                     # Contact doesn't exist, needs to be created
                     $StateIsCorrect = $false
-                    $Action = "Create"
+                    $Action = 'Create'
                     $Missing = $true
                 }
 
                 [PSCustomObject]@{
-                    missing         = $Missing
-                    StateIsCorrect  = $StateIsCorrect
-                    Action          = $Action
-                    Template        = $Template
-                    TemplateGUID    = $TemplateGUID
+                    missing        = $Missing
+                    StateIsCorrect = $StateIsCorrect
+                    Action         = $Action
+                    Template       = $Template
+                    TemplateGUID   = $TemplateGUID
                 }
-            }
-            catch {
+            } catch {
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                 $Message = "Failed to process template $TemplateGUID, Error: $ErrorMessage"
                 Write-LogMessage -API $APIName -tenant $tenant -message $Message -sev 'Error'
-                Return $Message
+                return $Message
             }
         }
 
         # Remediate each contact which needs to be created or updated
-        If ($RemediateEnabled) {
+        if ($RemediateEnabled) {
             $ContactsToProcess = $CompareList | Where-Object { $_.StateIsCorrect -eq $false }
 
             if ($ContactsToProcess.Count -gt 0) {
-                $ContactsToCreate = $ContactsToProcess | Where-Object { $_.Action -eq "Create" }
-                $ContactsToUpdate = $ContactsToProcess | Where-Object { $_.Action -eq "Update" }
+                $ContactsToCreate = $ContactsToProcess | Where-Object { $_.Action -eq 'Create' }
+                $ContactsToUpdate = $ContactsToProcess | Where-Object { $_.Action -eq 'Update' }
 
                 Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: Processing $($ContactsToCreate.Count) new contacts, $($ContactsToUpdate.Count) existing contacts" -sev Info
 
@@ -192,13 +188,12 @@ function Invoke-CIPPStandardDeployContactTemplates {
 
                         # Store contact info for second pass
                         $ProcessedContacts.Add([PSCustomObject]@{
-                            Contact = $Contact
-                            ContactObject = $NewContact
-                            Template = $Template
-                            IsNew = $true
-                        })
-                    }
-                    catch {
+                                Contact       = $Contact
+                                ContactObject = $NewContact
+                                Template      = $Template
+                                IsNew         = $true
+                            })
+                    } catch {
                         $ProcessingFailures++
                         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                         Write-LogMessage -API $APIName -tenant $tenant -message "Failed to create contact $($Template.displayName): $ErrorMessage" -sev 'Error'
@@ -213,7 +208,7 @@ function Invoke-CIPPStandardDeployContactTemplates {
 
                         # Update MailContact properties (email address)
                         $UpdateMailContactParams = @{
-                            Identity = $ExistingContact.Identity
+                            Identity             = $ExistingContact.Identity
                             ExternalEmailAddress = $Template.email
                         }
 
@@ -242,13 +237,12 @@ function Invoke-CIPPStandardDeployContactTemplates {
 
                         # Store contact info for second pass
                         $ProcessedContacts.Add([PSCustomObject]@{
-                            Contact = $Contact
-                            ContactObject = $ExistingContact
-                            Template = $Template
-                            IsNew = $false
-                        })
-                    }
-                    catch {
+                                Contact       = $Contact
+                                ContactObject = $ExistingContact
+                                Template      = $Template
+                                IsNew         = $false
+                            })
+                    } catch {
                         $ProcessingFailures++
                         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                         Write-LogMessage -API $APIName -tenant $tenant -message "Failed to update contact $($Template.displayName): $ErrorMessage" -sev 'Error'
@@ -326,8 +320,7 @@ function Invoke-CIPPStandardDeployContactTemplates {
                                     $null = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-MailContact' -cmdParams $MailContactParams -UseSystemMailbox $true
                                 }
                             }
-                        }
-                        catch {
+                        } catch {
                             $UpdateFailures++
                             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                             Write-LogMessage -API $APIName -tenant $tenant -message "Failed to update additional fields for contact $($Template.displayName): $ErrorMessage" -sev 'Error'
@@ -357,25 +350,36 @@ function Invoke-CIPPStandardDeployContactTemplates {
                     if ($Contact.missing) {
                         $CurrentInfo = $Contact.Template | Select-Object -Property displayName, email, missing
                         Write-StandardsAlert -message "Mail contact $($Contact.Template.displayName) from template $($Contact.TemplateGUID) is missing." -object $CurrentInfo -tenant $Tenant -standardName 'DeployContactTemplate'
-                    }
-                    else {
-                        $CurrentInfo = $CurrentContacts | Where-Object -Property DisplayName -eq $Contact.Template.displayName | Select-Object -Property DisplayName, ExternalEmailAddress, FirstName, LastName
+                    } else {
+                        $CurrentInfo = $CurrentContacts | Where-Object -Property DisplayName -EQ $Contact.Template.displayName | Select-Object -Property DisplayName, ExternalEmailAddress, FirstName, LastName
                         Write-StandardsAlert -message "Mail contact $($Contact.Template.displayName) from template $($Contact.TemplateGUID) will be updated to match template." -object $CurrentInfo -tenant $Tenant -standardName 'DeployContactTemplate'
                     }
                 }
                 Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: $MissingContacts missing, $ExistingContacts to update" -sev Info
             } else {
-                Write-LogMessage -API $APIName -tenant $Tenant -message "DeployContactTemplate: No contacts need processing" -sev Info
+                Write-LogMessage -API $APIName -tenant $Tenant -message 'DeployContactTemplate: No contacts need processing' -sev Info
             }
         }
 
         if ($ReportEnabled) {
-            foreach ($Contact in $CompareList) {
-                Set-CIPPStandardsCompareField -FieldName "standards.DeployContactTemplate" -FieldValue $Contact.StateIsCorrect -TenantFilter $Tenant
+            $ExpectedValue = [PSCustomObject]@{
+                state = 'Correctly configured'
+            }
+            $CurrentValue = if ($CompareList.StateIsCorrect -eq $true) {
+                [PSCustomObject]@{ state = 'Correctly configured' }
+            } else {
+                [PSCustomObject]@{
+                    MissingContacts  = $CompareList | Where-Object { $_.missing } | ForEach-Object {
+                        $_.Template | Select-Object -Property displayName, Email
+                    }
+                    ContactsToUpdate = $CompareList | Where-Object { -not $_.missing } | ForEach-Object {
+                        $_.Template | Select-Object -Property displayName, Email
+                    }
+                }
             }
+            Set-CIPPStandardsCompareField -FieldName 'standards.DeployContactTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         }
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API $APIName -tenant $tenant -message "Failed to create or update mail contact(s) from templates, Error: $ErrorMessage" -sev 'Error'
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1
index 01b2c06a8ae6..4ee810e1f85a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1
@@ -50,8 +50,7 @@ function Invoke-CIPPStandardDeployMailContact {
 
     try {
         $null = [System.Net.Mail.MailAddress]::new($Settings.ExternalEmailAddress)
-    }
-    catch {
+    } catch {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "DeployMailContact: Invalid email address format: $($Settings.ExternalEmailAddress)" -sev Error
         return
     }
@@ -70,12 +69,10 @@ function Invoke-CIPPStandardDeployMailContact {
             Identity    = $Settings.ExternalEmailAddress
             ErrorAction = 'Stop'
         }
-    }
-    catch {
+    } catch {
         if ($_.Exception.Message -like "*couldn't be found*") {
             $ExistingContact = $null
-        }
-        else {
+        } else {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Error checking for existing mail contact: $(Get-CippException -Exception $_).NormalizedError" -sev Error
             return
         }
@@ -88,8 +85,7 @@ function Invoke-CIPPStandardDeployMailContact {
             $NewContactParams.Name = $Settings.DisplayName
             $null = New-ExoRequest -tenantid $Tenant -cmdlet 'New-MailContact' -cmdParams $NewContactParams
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully created mail contact $($Settings.DisplayName) with email $($Settings.ExternalEmailAddress)" -sev Info
-        }
-        catch {
+        } catch {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not create mail contact. $(Get-CippException -Exception $_).NormalizedError" -sev Error
         }
     }
@@ -98,8 +94,7 @@ function Invoke-CIPPStandardDeployMailContact {
     if ($Settings.alert -eq $true) {
         if ($ExistingContact) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Mail contact $($Settings.DisplayName) already exists" -sev Info
-        }
-        else {
+        } else {
             Write-StandardsAlert -message "Mail contact $($Settings.DisplayName) needs to be created" -object $ContactData -tenant $Tenant -standardName 'DeployMailContact' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Mail contact $($Settings.DisplayName) needs to be created" -sev Info
         }
@@ -108,8 +103,9 @@ function Invoke-CIPPStandardDeployMailContact {
     # Report
     if ($Settings.report -eq $true) {
         $ReportData = $ContactData.Clone()
+        $CurrentValue = $ExistingContact | Select-Object DisplayName, ExternalEmailAddress, FirstName, LastName
         $ReportData.Exists = [bool]$ExistingContact
         Add-CIPPBPAField -FieldName 'DeployMailContact' -FieldValue $ReportData -StoreAs json -Tenant $Tenant
-        Set-CIPPStandardsCompareField -FieldName 'standards.DeployMailContact' -FieldValue $($ExistingContact ? $true : $ReportData) -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.DeployMailContact' -CurrentValue $CurrentValue -ExpectedValue $ReportData -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1
index 248c250d6b6f..5b43e27dbee0 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1
@@ -31,7 +31,7 @@ function Invoke-CIPPStandardDisableAddShortcutsToOneDrive {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableAddShortcutsToOneDrive' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableAddShortcutsToOneDrive' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
     ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableAddShortcutsToOneDrive'
 
     if ($TestResult -eq $false) {
@@ -41,9 +41,8 @@ function Invoke-CIPPStandardDisableAddShortcutsToOneDrive {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object _ObjectIdentity_, TenantFilter, DisableAddToOneDrive
-    }
-    catch {
+            Select-Object _ObjectIdentity_, TenantFilter, DisableAddToOneDrive
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableAddShortcutsToOneDrive state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -53,7 +52,14 @@ function Invoke-CIPPStandardDisableAddShortcutsToOneDrive {
     $StateValue = $Settings.state.value ?? $Settings.state
     if (([string]::IsNullOrWhiteSpace($StateValue) -or $StateValue -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
         Write-LogMessage -API 'Standards' -tenant $tenant -message 'DisableAddShortcutsToOneDrive: Invalid state parameter set' -sev Error
-        Return
+        return
+    }
+
+    $CurrentValue = [PSCustomObject]@{
+        DisableAddShortcutsToOneDrive = $CurrentState.DisableAddToOneDrive
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        DisableAddShortcutsToOneDrive = [System.Convert]::ToBoolean($StateValue)
     }
 
     $WantedState = [System.Convert]::ToBoolean($StateValue)
@@ -66,11 +72,11 @@ function Invoke-CIPPStandardDisableAddShortcutsToOneDrive {
         } else {
             $FieldValue = $CurrentState | Select-Object -Property DisableAddToOneDrive
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableAddShortcutsToOneDrive' -FieldValue $FieldValue -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableAddShortcutsToOneDrive' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'OneDriveAddShortcutButtonDisabled' -FieldValue $CurrentState.DisableAddToOneDrive -StoreAs bool -Tenant $Tenant
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
         if ($StateIsCorrect -eq $false) {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
index e3768e11b933..5a83612fc3b9 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
@@ -50,6 +50,13 @@ function Invoke-CIPPStandardDisableAdditionalStorageProviders {
         return
     }
 
+    $CurrentValue = [PSCustomObject]@{
+        AdditionalStorageProvidersAvailable = $AdditionalStorageProvidersState.AdditionalStorageProvidersAvailable
+    }
+    $ExpectedValue = [PSCustomObject]@{
+        AdditionalStorageProvidersAvailable = $false
+    }
+
     if ($Settings.remediate -eq $true) {
 
         try {
@@ -78,8 +85,8 @@ function Invoke-CIPPStandardDisableAdditionalStorageProviders {
     }
 
     if ($Settings.report -eq $true) {
-        $State = $AdditionalStorageProvidersState.AdditionalStorageProvidersEnabled ? $false : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableAdditionalStorageProviders' -FieldValue $State -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AdditionalStorageProvidersEnabled' -FieldValue $State -StoreAs bool -Tenant $Tenant
+        $State = $AdditionalStorageProvidersState.AdditionalStorageProvidersAvailable ? $false : $true
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableAdditionalStorageProviders' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+        Add-CIPPBPAField -FieldName 'AdditionalStorageProvidersAvailable' -FieldValue $State -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1
index a95bb94a6278..f0620e414878 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1
@@ -42,14 +42,18 @@ function Invoke-CIPPStandardDisableAppCreation {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy?$select=defaultUserRolePermissions' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableAppCreation state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    $CurrentValue = $CurrentInfo.defaultUserRolePermissions | Select-Object -Property allowedToCreateApps
+    $ExpectedValue = [PSCustomObject]@{
+        allowedToCreateApps = $false
+    }
+
+    if ($Settings.remediate -eq $true) {
         if ($CurrentInfo.defaultUserRolePermissions.allowedToCreateApps -eq $false) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are already not allowed to create App registrations.' -sev Info
         } else {
@@ -77,7 +81,7 @@ function Invoke-CIPPStandardDisableAppCreation {
 
     if ($Settings.report -eq $true) {
         $State = -not $CurrentInfo.defaultUserRolePermissions.allowedToCreateApps
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableAppCreation' -FieldValue $State -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableAppCreation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'UserAppCreationDisabled' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
index d2a75761de75..5d5e4b55f0c3 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
@@ -46,15 +46,14 @@ function Invoke-CIPPStandardDisableBasicAuthSMTP {
         $CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-TransportConfig'
 
         $SMTPusers = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-CASMailbox' -cmdParams @{ ResultSize = 'Unlimited' } |
-        Where-Object { ($_.SmtpClientAuthenticationDisabled -eq $false) }
-    }
-    catch {
+            Where-Object { ($_.SmtpClientAuthenticationDisabled -eq $false) }
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableBasicAuthSMTP state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
         if ($CurrentInfo.SmtpClientAuthenticationDisabled -and $SMTPusers.Count -eq 0) {
@@ -108,12 +107,22 @@ function Invoke-CIPPStandardDisableBasicAuthSMTP {
         }
 
         if ($Settings.report -eq $true) {
+
+            $CurrentValue = [PSCustomObject]@{
+                SmtpClientAuthenticationDisabled = $CurrentInfo.SmtpClientAuthenticationDisabled
+                UsersWithSmtpAuthEnabled         = @($SMTPusers.PrimarySmtpAddress)
+            }
+            $ExpectedValue = [PSCustomObject]@{
+                SmtpClientAuthenticationDisabled = $true
+                UsersWithSmtpAuthEnabled         = @()
+            }
+
+            Set-CIPPStandardsCompareField -FieldName 'standards.DisableBasicAuthSMTP' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+
             if ($CurrentInfo.SmtpClientAuthenticationDisabled -and $SMTPusers.Count -eq 0) {
-                Set-CIPPStandardsCompareField -FieldName 'standards.DisableBasicAuthSMTP' -FieldValue $true -TenantFilter $Tenant
                 Add-CIPPBPAField -FieldName 'DisableBasicAuthSMTP' -FieldValue $CurrentInfo.SmtpClientAuthenticationDisabled -StoreAs bool -Tenant $tenant
             } else {
                 $Logs = $LogMessage | Select-Object @{n = 'Message'; e = { $_ } }
-                Set-CIPPStandardsCompareField -FieldName 'standards.DisableBasicAuthSMTP' -FieldValue $logs -TenantFilter $Tenant
                 Add-CIPPBPAField -FieldName 'DisableBasicAuthSMTP' -FieldValue $Logs -StoreAs json -Tenant $tenant
             }
         }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1
index 58c0c89e84db..31729038577c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1
@@ -32,19 +32,17 @@ function Invoke-CIPPStandardDisableEmail {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableEmail'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Email' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableEmail state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = ($CurrentState.state -eq 'disabled')
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Email authentication method is already disabled.' -sev Info
         } else {
@@ -65,8 +63,14 @@ function Invoke-CIPPStandardDisableEmail {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect -eq $true ? $true :  $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableEmail' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            DisableEmail = $CurrentState.state -eq 'disabled'
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableEmail = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableEmail' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableEmail' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
index 1f791cbd4b26..bd774e10251c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
@@ -10,7 +10,6 @@ function Invoke-CIPPStandardDisableEntraPortal {
     #>
 
     param($Tenant, $Settings)
-    #$Rerun -Type Standard -Tenant $Tenant -API 'allowOTPTokens' -Settings $Settings
     #This standard is still unlisted due to MS fixing some permissions. This will be added to the list once it is fixed.
     try {
         $CurrentInfo = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/admin/entra/uxSetting' -tenantid $Tenant
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1
index 016557aa7124..ff49eefefeef 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1
@@ -95,8 +95,14 @@ function Invoke-CIPPStandardDisableExchangeOnlinePowerShell {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ?? @{UsersWithPowerShellEnabled = $PowerShellEnabledCount }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableExchangeOnlinePowerShell' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            UsersWithPowerShellEnabled = $PowerShellEnabledCount
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            UsersWithPowerShellEnabled = 0
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableExchangeOnlinePowerShell' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'ExchangeOnlinePowerShellDisabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
index fca63098a8cc..d8bf42551e92 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
@@ -39,13 +39,11 @@ function Invoke-CIPPStandardDisableExternalCalendarSharing {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableExternalCalendarSharing'
 
     try {
         $CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SharingPolicy' |
-        Where-Object { $_.Default -eq $true }
-    }
-    catch {
+            Where-Object { $_.Default -eq $true }
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableExternalCalendarSharing state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -79,8 +77,16 @@ function Invoke-CIPPStandardDisableExternalCalendarSharing {
     }
 
     if ($Settings.report -eq $true) {
-        $CurrentInfo.Enabled = -not $CurrentInfo.Enabled
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableExternalCalendarSharing' -FieldValue $CurrentInfo.Enabled -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ExternalCalendarSharingDisabled' -FieldValue $CurrentInfo.Enabled -StoreAs bool -Tenant $tenant
+        $CurrentStatus = -not $CurrentInfo.Enabled
+
+        $CurrentValue = [PSCustomObject]@{
+            ExternalCalendarSharingDisabled = $CurrentStatus
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            ExternalCalendarSharingDisabled = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableExternalCalendarSharing' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+        Add-CIPPBPAField -FieldName 'ExternalCalendarSharingDisabled' -FieldValue $CurrentStatus -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1
index 83179a83634b..f4ec96f9f33d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1
@@ -37,19 +37,16 @@ function Invoke-CIPPStandardDisableGuestDirectory {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableGuestDirectory'
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableGuestDirectory state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
-
+    if ($Settings.remediate -eq $true) {
         if ($CurrentInfo.guestUserRoleId -eq '2af84b1e-32c8-42b7-82bc-daa82404023b') {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Guest access to directory information is already disabled.' -sev Info
         } else {
@@ -65,7 +62,6 @@ function Invoke-CIPPStandardDisableGuestDirectory {
     }
 
     if ($Settings.alert -eq $true) {
-
         if ($CurrentInfo.guestUserRoleId -eq '2af84b1e-32c8-42b7-82bc-daa82404023b') {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Guest access to directory information is disabled.' -sev Info
         } else {
@@ -75,8 +71,16 @@ function Invoke-CIPPStandardDisableGuestDirectory {
     }
 
     if ($Settings.report -eq $true) {
-        if ($CurrentInfo.guestUserRoleId -eq '2af84b1e-32c8-42b7-82bc-daa82404023b') { $CurrentInfo.guestUserRoleId = $true } else { $CurrentInfo.guestUserRoleId = $false }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableGuestDirectory' -FieldValue $CurrentInfo.guestUserRoleId -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableGuestDirectory' -FieldValue $CurrentInfo.guestUserRoleId -StoreAs bool -Tenant $tenant
+        if ($CurrentInfo.guestUserRoleId -eq '2af84b1e-32c8-42b7-82bc-daa82404023b') { $CurrentStatus = $true } else { $CurrentStatus = $false }
+
+        $CurrentValue = [PSCustomObject]@{
+            GuestDirectoryAccessDisabled = $CurrentStatus
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            GuestDirectoryAccessDisabled = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableGuestDirectory' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+        Add-CIPPBPAField -FieldName 'DisableGuestDirectory' -FieldValue $CurrentStatus -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1
index a4169524521d..de4789652b77 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1
@@ -91,8 +91,20 @@ function Invoke-CIPPStandardDisableGuests {
     }
     if ($Settings.report -eq $true) {
         $Filtered = $GraphRequest | Select-Object -Property UserPrincipalName, id, signInActivity, mail, userType, accountEnabled
-        $State = $Filtered ? $Filtered : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableGuests' -FieldValue $State -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            GuestsDisabledAfterDays      = $checkDays
+            GuestsDisabledAccountCount   = $Filtered.Count
+            GuestsDisabledAccountDetails = @($Filtered)
+        }
+
+        $ExpectedValue = [PSCustomObject]@{
+            GuestsDisabledAfterDays      = $checkDays
+            GuestsDisabledAccountCount   = 0
+            GuestsDisabledAccountDetails = @()
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableGuests' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableGuests' -FieldValue $Filtered -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1
index 174eeef2fd89..4919d502721f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1
@@ -31,8 +31,7 @@ function Invoke-CIPPStandardDisableM365GroupUsers {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableM365GroupUsers' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableM365GroupUsers'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableM365GroupUsers' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -41,15 +40,14 @@ function Invoke-CIPPStandardDisableM365GroupUsers {
 
     try {
         $CurrentState = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/settings' -tenantid $tenant) |
-        Where-Object -Property displayname -EQ 'Group.unified'
-    }
-    catch {
+            Where-Object -Property displayname -EQ 'Group.unified'
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableM365GroupUsers state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if (($CurrentState.values | Where-Object { $_.name -eq 'EnableGroupCreation' }).value -eq 'false') {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are already disabled from creating M365 Groups.' -sev Info
         } else {
@@ -94,7 +92,15 @@ function Invoke-CIPPStandardDisableM365GroupUsers {
         } else {
             $CurrentState = $false
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableM365GroupUsers' -FieldValue $CurrentState -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            M365GroupUserCreationDisabled = $CurrentState
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            M365GroupUserCreationDisabled = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableM365GroupUsers' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableM365GroupUsers' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
index 483d7b3c1219..42c955f5186f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
@@ -41,13 +41,11 @@ function Invoke-CIPPStandardDisableOutlookAddins {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableOutlookAddins'
 
     try {
         $CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-RoleAssignmentPolicy' |
-        Where-Object { $_.IsDefault -eq $true }
-    }
-    catch {
+            Where-Object { $_.IsDefault -eq $true }
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableOutlookAddins state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -97,8 +95,15 @@ function Invoke-CIPPStandardDisableOutlookAddins {
     }
     if ($Settings.report -eq $true) {
         $State = if ($RolesToRemove) { $false } else { $true }
-        $StateForCompare = if ($RolesToRemove) { @{ AllowedApps = $RolesToRemove } } else { $true }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableOutlookAddins' -FieldValue $StateForCompare -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            DisabledOutlookAddins = $State
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisabledOutlookAddins = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableOutlookAddins' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisabledOutlookAddins' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1
index cd3ad4ca11e5..244a867a3d3e 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1
@@ -63,7 +63,15 @@ function Invoke-CIPPStandardDisableQRCodePin {
 
     if ($Settings.report -eq $true) {
         $state = $StateIsCorrect -eq $true ? $true :  $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableQRCodePin' -FieldValue $state -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            DisableQRCodePin = $state
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableQRCodePin = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableQRCodePin' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableQRCodePin' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1
index 00907b647f35..3e29a5d81a3b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1
@@ -35,8 +35,7 @@ function Invoke-CIPPStandardDisableReshare {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableReshare' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableReshare'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableReshare' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -45,14 +44,13 @@ function Invoke-CIPPStandardDisableReshare {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableReshare state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         if ($CurrentInfo.isResharingByExternalUsersEnabled) {
             try {
@@ -79,7 +77,15 @@ function Invoke-CIPPStandardDisableReshare {
 
     if ($Settings.report -eq $true) {
         $state = $CurrentInfo.isResharingByExternalUsersEnabled ? ($CurrentInfo | Select-Object isResharingByExternalUsersEnabled) : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableReshare' -FieldValue $state -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            DisableReshare = $state
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableReshare = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableReshare' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableReshare' -FieldValue $CurrentInfo.isResharingByExternalUsersEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1
index 5f6509f7baa1..ca70a1330275 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1
@@ -39,22 +39,20 @@ function Invoke-CIPPStandardDisableResourceMailbox {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableResourceMailbox'
 
     # Get all users that are able to be
     try {
         $UserList = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/users?$top=999&$filter=accountEnabled eq true and onPremisesSyncEnabled ne true and assignedLicenses/$count eq 0&$count=true' -Tenantid $Tenant -ComplexFilter |
-        Where-Object { $_.userType -eq 'Member' }
+            Where-Object { $_.userType -eq 'Member' }
         $ResourceMailboxList = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ Filter = "RecipientTypeDetails -eq 'RoomMailbox' -or RecipientTypeDetails -eq 'EquipmentMailbox'" } -Select 'UserPrincipalName,DisplayName,RecipientTypeDetails,ExternalDirectoryObjectId' |
-        Where-Object { $_.ExternalDirectoryObjectId -in $UserList.id }
-    }
-    catch {
+            Where-Object { $_.ExternalDirectoryObjectId -in $UserList.id }
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableResourceMailbox state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
 
@@ -85,9 +83,14 @@ function Invoke-CIPPStandardDisableResourceMailbox {
     }
 
     if ($Settings.report -eq $true) {
-        # If there are no resource mailboxes, we set the state to true, so that the standard reports as compliant.
-        $State = $ResourceMailboxList ? $ResourceMailboxList : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableResourceMailbox' -FieldValue $State -Tenant $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            ResourceMailboxesToDisable = @($ResourceMailboxList)
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            ResourceMailboxesToDisable = @()
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableResourceMailbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableResourceMailbox' -FieldValue $ResourceMailboxList -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1
index 9e31319e9e74..f793a36cad48 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1
@@ -34,19 +34,17 @@ function Invoke-CIPPStandardDisableSMS {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableSMS'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/SMS' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableSMS state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = ($CurrentState.state -eq 'disabled')
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'SMS authentication method is already disabled.' -sev Info
         } else {
@@ -67,7 +65,15 @@ function Invoke-CIPPStandardDisableSMS {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSMS' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            DisableSMS = $StateIsCorrect
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableSMS = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSMS' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableSMS' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1
index 2ebc31ab174f..a114b59134bd 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1
@@ -32,18 +32,16 @@ function Invoke-CIPPStandardDisableSecurityGroupUsers {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableSecurityGroupUsers'
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableSecurityGroupUsers state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($CurrentInfo.defaultUserRolePermissions.allowedToCreateSecurityGroups -eq $false) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Users are already not allowed to create Security Groups.' -sev Info
         } else {
@@ -70,8 +68,14 @@ function Invoke-CIPPStandardDisableSecurityGroupUsers {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $CurrentInfo.defaultUserRolePermissions.allowedToCreateSecurityGroups -eq $false ? $true : ($currentInfo.defaultUserRolePermissions | Select-Object allowedToCreateSecurityGroups)
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSecurityGroupUsers' -FieldValue $state -Tenant $tenant
+        $CurrentValue = [PSCustomObject]@{
+            DisableSecurityGroupUsers = $CurrentInfo.defaultUserRolePermissions.allowedToCreateSecurityGroups -eq $false
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableSecurityGroupUsers = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSecurityGroupUsers' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'DisableSecurityGroupUsers' -FieldValue $CurrentInfo.defaultUserRolePermissions.allowedToCreateSecurityGroups -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
index 84aa8b9e166d..41dc31365e43 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
@@ -31,7 +31,6 @@ function Invoke-CIPPStandardDisableSelfServiceLicenses {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableSelfServiceLicenses'
 
     try {
         $selfServiceItems = (New-GraphGETRequest -scope 'aeb86249-8ea3-49e2-900b-54cc8e308f85/.default' -uri 'https://licensing.m365.microsoft.com/v1.0/policies/AllowSelfServicePurchase/products' -tenantid $Tenant).items
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1
index 3f3ad436c31a..88b113d8d554 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1
@@ -37,8 +37,7 @@ function Invoke-CIPPStandardDisableSharePointLegacyAuth {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableSharePointLegacyAuth' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableSharePointLegacyAuth'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableSharePointLegacyAuth' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -47,14 +46,13 @@ function Invoke-CIPPStandardDisableSharePointLegacyAuth {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings?$select=isLegacyAuthProtocolsEnabled' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableSharePointLegacyAuth state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         if ($CurrentInfo.isLegacyAuthProtocolsEnabled) {
             try {
@@ -80,8 +78,14 @@ function Invoke-CIPPStandardDisableSharePointLegacyAuth {
         }
     }
     if ($Settings.report -eq $true) {
-        $state = $CurrentInfo.isLegacyAuthProtocolsEnabled ? ($CurrentInfo | Select-Object isLegacyAuthProtocolsEnabled) : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSharePointLegacyAuth' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            DisableSharePointLegacyAuth = $CurrentInfo.isLegacyAuthProtocolsEnabled -eq $false
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableSharePointLegacyAuth = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSharePointLegacyAuth' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'SharePointLegacyAuthEnabled' -FieldValue $CurrentInfo.isLegacyAuthProtocolsEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
index ce4ee3ecd59a..01b501aec319 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
@@ -35,19 +35,17 @@ function Invoke-CIPPStandardDisableSharedMailbox {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableSharedMailbox'
 
     try {
         $UserList = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/users?$top=999&$filter=accountEnabled eq true and onPremisesSyncEnabled ne true&$count=true' -Tenantid $Tenant -ComplexFilter
-        $SharedMailboxList = (New-GraphGetRequest -uri "https://outlook.office365.com/adminapi/beta/$($Tenant)/Mailbox" -Tenantid $Tenant -scope ExchangeOnline | Where-Object { $_.RecipientTypeDetails -EQ 'SharedMailbox' -or $_.RecipientTypeDetails -eq 'SchedulingMailbox' -and $_.UserPrincipalName -in $UserList.UserPrincipalName })
-    }
-    catch {
+        $SharedMailboxList = (New-GraphGetRequest -uri "https://outlook.office365.com/adminapi/beta/$($Tenant)/Mailbox" -Tenantid $Tenant -scope ExchangeOnline | Where-Object { $_.RecipientTypeDetails -eq 'SharedMailbox' -or $_.RecipientTypeDetails -eq 'SchedulingMailbox' -and $_.UserPrincipalName -in $UserList.UserPrincipalName })
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableSharedMailbox state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         if ($SharedMailboxList) {
             $SharedMailboxList | ForEach-Object {
@@ -75,8 +73,16 @@ function Invoke-CIPPStandardDisableSharedMailbox {
     }
 
     if ($Settings.report -eq $true) {
-        $State = $SharedMailboxList ? $SharedMailboxList : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSharedMailbox' -FieldValue $State -Tenant $Tenant
+        $State = $SharedMailboxList ? $SharedMailboxList : @()
+
+        $CurrentValue = [PSCustomObject]@{
+            DisableSharedMailbox = @($State)
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableSharedMailbox = @()
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableSharedMailbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'DisableSharedMailbox' -FieldValue $SharedMailboxList -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
index 37453584a858..e82a30d9de1a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
@@ -31,7 +31,6 @@ function Invoke-CIPPStandardDisableTNEF {
     #>
 
     param ($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableTNEF'
     $TestResult = Test-CIPPStandardLicense -StandardName 'DisableTNEF' -TenantFilter $Tenant -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_S_STANDARD_GOV', 'EXCHANGE_S_ENTERPRISE_GOV', 'EXCHANGE_LITE') #No Foundation because that does not allow powershell access
 
     if ($TestResult -eq $false) {
@@ -41,8 +40,7 @@ function Invoke-CIPPStandardDisableTNEF {
 
     try {
         $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-RemoteDomain' -cmdParams @{Identity = 'Default' }
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableTNEF state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -76,7 +74,15 @@ function Invoke-CIPPStandardDisableTNEF {
 
     if ($Settings.report -eq $true) {
         $State = if ($CurrentState.TNEFEnabled -ne $false) { $false } else { $true }
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableTNEF' -FieldValue $State -Tenant $tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            DisableTNEF = $State
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableTNEF = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableTNEF' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'TNEFDisabled' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1
index f5023093a594..c68199c54554 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1
@@ -34,19 +34,17 @@ function Invoke-CIPPStandardDisableTenantCreation {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableTenantCreation'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableTenantCreation state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = ($CurrentState.defaultUserRolePermissions.allowedToCreateTenants -eq $false)
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host "Time to remediate DisableTenantCreation standard for tenant $Tenant"
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Users are already disabled from creating tenants.' -sev Info
@@ -77,7 +75,14 @@ function Invoke-CIPPStandardDisableTenantCreation {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableTenantCreation' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            DisableTenantCreation = $StateIsCorrect
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableTenantCreation = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableTenantCreation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableTenantCreation' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
index 20c91e310e65..2eeda69ca0f1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
@@ -30,8 +30,7 @@ function Invoke-CIPPStandardDisableUserSiteCreate {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableUserSiteCreate' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableUserSiteCreate'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'DisableUserSiteCreate' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -40,14 +39,13 @@ function Invoke-CIPPStandardDisableUserSiteCreate {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableUserSiteCreate state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         if ($CurrentInfo.isSiteCreationEnabled -or $CurrentInfo.isSiteCreationUIEnabled) {
             try {
@@ -76,7 +74,15 @@ function Invoke-CIPPStandardDisableUserSiteCreate {
 
     if ($Settings.report -eq $true) {
         $state = $CurrentInfo.isSiteCreationEnabled -and $CurrentInfo.isSiteCreationUIEnabled ? ($CurrentInfo | Select-Object isSiteCreationEnabled, isSiteCreationUIEnabled) : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableUserSiteCreate' -FieldValue $State -Tenant $tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            DisableUserSiteCreate = $state
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableUserSiteCreate = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableUserSiteCreate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableUserSiteCreate' -FieldValue $CurrentInfo.isSiteCreationEnabled -StoreAs bool -Tenant $tenant
         Add-CIPPBPAField -FieldName 'DisableUserSiteCreateUI' -FieldValue $CurrentInfo.isSiteCreationUIEnabled -StoreAs bool -Tenant $tenant
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
index 5cae497f3b8d..4ae2623e8e1b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
@@ -30,7 +30,6 @@ function Invoke-CIPPStandardDisableViva {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableViva'
 
     try {
         # TODO This does not work without Global Admin permissions for some reason. Throws an "EXCEPTION: Tenant admin role is required" error. -Bobby
@@ -38,10 +37,10 @@ function Invoke-CIPPStandardDisableViva {
     } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to get Viva insights settings. Error: $ErrorMessage" -sev Error
-        Return
+        return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
 
         if ($CurrentSetting.isEnabledInOrganization -eq $false) {
@@ -68,8 +67,14 @@ function Invoke-CIPPStandardDisableViva {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $CurrentSetting.isEnabledInOrganization ? $true : ($CurrentSetting | Select-Object isEnabledInOrganization)
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableViva' -FieldValue $State -Tenant $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            DisableViva = -not $CurrentSetting.isEnabledInOrganization
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableViva = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableViva' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableViva' -FieldValue $CurrentSetting.isEnabledInOrganization -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1
index 4e53abdff35a..254bb83e0d4e 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1
@@ -34,19 +34,17 @@ function Invoke-CIPPStandardDisableVoice {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'DisableVoice'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Voice' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableVoice state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = ($CurrentState.state -eq 'disabled')
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'Voice authentication method is already disabled.' -sev Info
         } else {
@@ -67,7 +65,14 @@ function Invoke-CIPPStandardDisableVoice {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.DisableVoice' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            DisableVoice = $StateIsCorrect
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            DisableVoice = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.DisableVoice' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'DisableVoice' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1
index 3424827b8efa..5ea05a264e08 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1
@@ -30,19 +30,17 @@ function Invoke-CIPPStandardDisablex509Certificate {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'Disablex509Certificate'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/x509Certificate' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the Disablex509Certificate state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = ($CurrentState.state -eq 'disabled')
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'x509Certificate authentication method is already disabled.' -sev Info
         } else {
@@ -63,8 +61,14 @@ function Invoke-CIPPStandardDisablex509Certificate {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.Disablex509Certificate' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            Disablex509Certificate = $StateIsCorrect
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            Disablex509Certificate = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.Disablex509Certificate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'Disablex509Certificate' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1
index 1d21de6a55e3..81bfe45e8006 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1
@@ -32,13 +32,12 @@ function Invoke-CIPPStandardEXODirectSend {
 
     param ($Tenant, $Settings)
 
-
     # Determine desired state. These double negative MS loves are a bit confusing
     $DesiredStateName = $Settings.state.value ?? $Settings.state
     # Input validation
     if ([string]::IsNullOrWhiteSpace($DesiredStateName) -or $DesiredStateName -eq 'Select a value') {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message 'EXODirectSend: Invalid state parameter set' -sev Error
-        Return
+        return
     }
 
     # Get current organization config
@@ -85,8 +84,13 @@ function Invoke-CIPPStandardEXODirectSend {
 
     # Report if needed
     if ($Settings.report -eq $true) {
-
-        Set-CIPPStandardsCompareField -FieldName 'standards.EXODirectSend' -FieldValue $StateIsCorrect -Tenant $Tenant
+        $ExpectedState = @{
+            RejectDirectSend = $DesiredState
+        }
+        $CurrentState = @{
+            RejectDirectSend = $CurrentConfig
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.EXODirectSend' -CurrentValue $CurrentState -ExpectedValue $ExpectedState -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'EXODirectSend' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1
index 9b51a323a138..f39c7de785f5 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1
@@ -43,7 +43,6 @@ function Invoke-CIPPStandardEXODisableAutoForwarding {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EXODisableAutoForwarding'
 
     try {
         $CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-HostedOutboundSpamFilterPolicy' -cmdParams @{Identity = 'Default' } -useSystemMailbox $true
@@ -75,8 +74,14 @@ function Invoke-CIPPStandardEXODisableAutoForwarding {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ?? ($CurrentInfo | Select-Object AutoForwardingMode)
-        Set-CIPPStandardsCompareField -FieldName 'standards.EXODisableAutoForwarding' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = @{
+            AutoForwardingMode = $CurrentInfo.AutoForwardingMode
+        }
+        $ExpectedValue = @{
+            AutoForwardingMode = 'Off'
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EXODisableAutoForwarding' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'AutoForwardingDisabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1
index 21093d8428ea..537bb0133407 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1
@@ -7,7 +7,7 @@ function Invoke-CIPPStandardEXOOutboundSpamLimits {
     .SYNOPSIS
         (Label) Set Exchange Outbound Spam Limits
     .DESCRIPTION
-        (Helptext) Configures the outbound spam recipient limits (external per hour, internal per hour, per day) and the action to take when a limit is reached. The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one. 
+        (Helptext) Configures the outbound spam recipient limits (external per hour, internal per hour, per day) and the action to take when a limit is reached. The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one.
         (DocsDescription) Configures the Exchange Online outbound spam recipient limits for external per hour, internal per hour, and per day, along with the action to take (e.g., BlockUser, Alert) when these limits are exceeded. This helps prevent abuse and manage email flow. Microsoft's recommendations can be found [here.](https://learn.microsoft.com/en-us/defender-office-365/recommended-settings-for-eop-and-office365#eop-outbound-spam-policy-settings) The 'Set Outbound Spam Alert e-mail' standard is recommended to configure together with this one.
     .NOTES
         CAT
@@ -72,9 +72,8 @@ function Invoke-CIPPStandardEXOOutboundSpamLimits {
     # Get current settings
     try {
         $CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-HostedOutboundSpamFilterPolicy' -cmdParams @{Identity = 'Default' } -Select 'RecipientLimitExternalPerHour, RecipientLimitInternalPerHour, RecipientLimitPerDay, ActionWhenThresholdReached' -useSystemMailbox $true |
-        Select-Object -ExcludeProperty *data.type*
-    }
-    catch {
+            Select-Object -ExcludeProperty *data.type*
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EXOOutboundSpamLimits state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -82,12 +81,12 @@ function Invoke-CIPPStandardEXOOutboundSpamLimits {
 
     # Check if settings are already correct
     $StateIsCorrect = ($CurrentInfo.RecipientLimitExternalPerHour -eq $Settings.RecipientLimitExternalPerHour) -and
-                        ($CurrentInfo.RecipientLimitInternalPerHour -eq $Settings.RecipientLimitInternalPerHour) -and
-                        ($CurrentInfo.RecipientLimitPerDay -eq $Settings.RecipientLimitPerDay) -and
-                        ($CurrentInfo.ActionWhenThresholdReached -eq $ActionWhenThresholdReached)
+    ($CurrentInfo.RecipientLimitInternalPerHour -eq $Settings.RecipientLimitInternalPerHour) -and
+    ($CurrentInfo.RecipientLimitPerDay -eq $Settings.RecipientLimitPerDay) -and
+    ($CurrentInfo.ActionWhenThresholdReached -eq $ActionWhenThresholdReached)
 
     # Remediation
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         Write-Host 'Time to remediate'
         if ($StateIsCorrect -eq $false) {
             try {
@@ -121,8 +120,20 @@ function Invoke-CIPPStandardEXOOutboundSpamLimits {
 
     # Report
     if ($Settings.report -eq $true) {
-        $State = $StateIsCorrect ? $true : $CurrentInfo
-        Set-CIPPStandardsCompareField -FieldName 'standards.EXOOutboundSpamLimits' -FieldValue $State -TenantFilter $Tenant
+        $CurrentValue = @{
+            RecipientLimitExternalPerHour = $CurrentInfo.RecipientLimitExternalPerHour
+            RecipientLimitInternalPerHour = $CurrentInfo.RecipientLimitInternalPerHour
+            RecipientLimitPerDay          = $CurrentInfo.RecipientLimitPerDay
+            ActionWhenThresholdReached    = $CurrentInfo.ActionWhenThresholdReached
+        }
+        $ExpectedValue = @{
+            RecipientLimitExternalPerHour = [Int32]$Settings.RecipientLimitExternalPerHour
+            RecipientLimitInternalPerHour = [Int32]$Settings.RecipientLimitInternalPerHour
+            RecipientLimitPerDay          = [Int32]$Settings.RecipientLimitPerDay
+            ActionWhenThresholdReached    = $ActionWhenThresholdReached
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EXOOutboundSpamLimits' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'OutboundSpamLimitsConfigured' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1
index 93c488c8637d..21a52e52dda7 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1
@@ -41,18 +41,16 @@ function Invoke-CIPPStandardEnableAppConsentRequests {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableAppConsentRequests'
 
     try {
         $CurrentInfo = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/adminConsentRequestPolicy' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnableAppConsentRequests state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         try {
             # Get current state
 
@@ -121,8 +119,17 @@ function Invoke-CIPPStandardEnableAppConsentRequests {
         }
     }
     if ($Settings.report -eq $true) {
-        $state = $CurrentInfo.isEnabled ? $true : $CurrentInfo
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableAppConsentRequests' -FieldValue $state -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            EnableAppConsentRequests = $CurrentInfo.isEnabled
+            ReviewerCount            = $CurrentInfo.reviewers.count
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnableAppConsentRequests = $true
+            ReviewerCount            = ($Settings.ReviewerRoles.value).count
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableAppConsentRequests' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'EnableAppConsentAdminRequests' -FieldValue $CurrentInfo.isEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
index 60c87aaa5359..f790392524ba 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
@@ -33,7 +33,6 @@ function Invoke-CIPPStandardEnableCustomerLockbox {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableCustomerLockbox'
     $TestResult = Test-CIPPStandardLicense -StandardName 'EnableCustomerLockbox' -TenantFilter $Tenant -RequiredCapabilities @('CustomerLockbox')
 
     if ($TestResult -eq $false) {
@@ -43,8 +42,7 @@ function Invoke-CIPPStandardEnableCustomerLockbox {
 
     try {
         $CustomerLockboxStatus = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').CustomerLockboxEnabled
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnableCustomerLockbox state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -81,7 +79,15 @@ function Invoke-CIPPStandardEnableCustomerLockbox {
 
     if ($Settings.report -eq $true) {
         $state = $CustomerLockboxStatus ? $true : $false
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableCustomerLockbox' -FieldValue $state -Tenant $tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            EnableCustomerLockbox = $CustomerLockboxStatus
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnableCustomerLockbox = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableCustomerLockbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
         Add-CIPPBPAField -FieldName 'CustomerLockboxEnabled' -FieldValue $CustomerLockboxStatus -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1
index 873b902eca0b..f137fd8d8534 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1
@@ -38,19 +38,17 @@ function Invoke-CIPPStandardEnableFIDO2 {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableFIDO2'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/Fido2' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnableFIDO2 state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = ($CurrentState.state -eq 'enabled')
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'FIDO2 Support is already enabled.' -sev Info
         } else {
@@ -65,14 +63,20 @@ function Invoke-CIPPStandardEnableFIDO2 {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'FIDO2 Support is enabled' -sev Info
         } else {
-            Write-StandardsAlert -message "FIDO2 Support is not enabled" -object $CurrentState -tenant $tenant -standardName 'EnableFIDO2' -standardId $Settings.standardId
+            Write-StandardsAlert -message 'FIDO2 Support is not enabled' -object $CurrentState -tenant $tenant -standardName 'EnableFIDO2' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'FIDO2 Support is not enabled' -sev Info
         }
     }
 
     if ($Settings.report -eq $true) {
         $state = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableFIDO2' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = [PSCustomObject]@{
+            EnableFIDO2 = $state
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnableFIDO2 = $true
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableFIDO2' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'EnableFIDO2' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1
index 2f72f66f0136..2977733b7fc1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1
@@ -30,19 +30,17 @@ function Invoke-CIPPStandardEnableHardwareOAuth {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableHardwareOAuth'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/HardwareOath' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnableHardwareOAuth state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = ($CurrentState.state -eq 'enabled')
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'HardwareOAuth Support is already enabled.' -sev Info
         } else {
@@ -57,14 +55,22 @@ function Invoke-CIPPStandardEnableHardwareOAuth {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'HardwareOAuth Support is enabled' -sev Info
         } else {
-            Write-StandardsAlert -message "HardwareOAuth Support is not enabled" -object $CurrentState -tenant $tenant -standardName 'EnableHardwareOAuth' -standardId $Settings.standardId
+            Write-StandardsAlert -message 'HardwareOAuth Support is not enabled' -object $CurrentState -tenant $tenant -standardName 'EnableHardwareOAuth' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'HardwareOAuth Support is not enabled' -sev Info
         }
     }
 
     if ($Settings.report -eq $true) {
         $state = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableHardwareOAuth' -FieldValue $state -TenantFilter $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            EnableHardwareOAuth = $state
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnableHardwareOAuth = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableHardwareOAuth' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'EnableHardwareOAuth' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1
index 1476f7eab82d..0b7f49ac521e 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1
@@ -37,7 +37,6 @@ function Invoke-CIPPStandardEnableLitigationHold {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableLitigationHold'
 
     try {
         $MailboxesNoLitHold = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ Filter = 'LitigationHoldEnabled -eq "False"' } -Select 'UserPrincipalName,PersistedCapabilities,LitigationHoldEnabled' |
@@ -94,8 +93,16 @@ function Invoke-CIPPStandardEnableLitigationHold {
 
     if ($Settings.report -eq $true) {
         $filtered = $MailboxesNoLitHold | Select-Object -Property UserPrincipalName
-        $state = $filtered ? $MailboxesNoLitHold : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableLitigationHold' -FieldValue $state -Tenant $Tenant
+        $state = $filtered ? $MailboxesNoLitHold : @()
+
+        $CurrentValue = [PSCustomObject]@{
+            EnableLitigationHold = @($state)
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnableLitigationHold = @()
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableLitigationHold' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'EnableLitHold' -FieldValue $filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
index 0ab55ef1a2c9..c76f81dd6e3f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
@@ -41,12 +41,10 @@ function Invoke-CIPPStandardEnableMailTips {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableMailTips'
 
     try {
         $MailTipsState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig' | Select-Object MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, MailTipsGroupMetricsEnabled, MailTipsLargeAudienceThreshold
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnableMailTips state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -79,8 +77,15 @@ function Invoke-CIPPStandardEnableMailTips {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : $MailTipsState
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableMailTips' -FieldValue $State -Tenant $tenant
+        $CurrentValue = $MailTipsState
+        $ExpectedValue = [PSCustomObject]@{
+            MailTipsAllTipsEnabled                = $true
+            MailTipsExternalRecipientsTipsEnabled = $true
+            MailTipsGroupMetricsEnabled           = $true
+            MailTipsLargeAudienceThreshold        = $Settings.MailTipsLargeAudienceThreshold
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableMailTips' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
         Add-CIPPBPAField -FieldName 'MailTipsEnabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
index 7f5edd9b41c6..5bfab677b1d9 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
@@ -45,7 +45,6 @@ function Invoke-CIPPStandardEnableMailboxAuditing {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableMailboxAuditing'
 
     try {
         $AuditState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').AuditDisabled
@@ -142,7 +141,15 @@ function Invoke-CIPPStandardEnableMailboxAuditing {
 
     if ($Settings.report -eq $true) {
         $AuditState = -not $AuditState
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableMailboxAuditing' -FieldValue $AuditState -Tenant $Tenant
+
+        $CurrentValue = [PSCustomObject]@{
+            EnableMailboxAuditing = $AuditState
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnableMailboxAuditing = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableMailboxAuditing' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'MailboxAuditingEnabled' -FieldValue $AuditState -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1
index c24373226143..21d676aa2253 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1
@@ -36,7 +36,7 @@ function Invoke-CIPPStandardEnableNamePronunciation {
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not get CurrentState for Name Pronunciation. Error: $($ErrorMessage.NormalizedError)" -sev Error
-        Return
+        return
     }
     Write-Host $CurrentState
 
@@ -69,7 +69,14 @@ function Invoke-CIPPStandardEnableNamePronunciation {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableNamePronunciation' -FieldValue $CurrentState.isEnabledInOrganization -Tenant $tenant
+        $CurrentValue = [PSCustomObject]@{
+            EnableNamePronunciation = $CurrentState.isEnabledInOrganization
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnableNamePronunciation = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableNamePronunciation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
         Add-CIPPBPAField -FieldName 'NamePronunciationEnabled' -FieldValue $CurrentState.isEnabledInOrganization -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
index bb0389b0988d..b69034289ed8 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
@@ -38,7 +38,6 @@ function Invoke-CIPPStandardEnableOnlineArchiving {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnableOnlineArchiving'
 
     $MailboxPlans = @( 'ExchangeOnline', 'ExchangeOnlineEnterprise' )
     $MailboxesNoArchive = $MailboxPlans | ForEach-Object {
@@ -46,7 +45,7 @@ function Invoke-CIPPStandardEnableOnlineArchiving {
         Write-Host "Getting mailboxes without Online Archiving for plan $_"
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         if ($null -eq $MailboxesNoArchive) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Online Archiving already enabled for all accounts' -sev Info
@@ -90,8 +89,16 @@ function Invoke-CIPPStandardEnableOnlineArchiving {
 
     if ($Settings.report -eq $true) {
         $filtered = $MailboxesNoArchive | Select-Object -Property UserPrincipalName, ArchiveGuid
-        $stateReport = $filtered ? $filtered : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnableOnlineArchiving' -FieldValue $stateReport -TenantFilter $Tenant
+        $stateReport = $filtered ? $filtered : @()
+
+        $CurrentValue = [PSCustomObject]@{
+            ArchiveNotEnabled = @($stateReport)
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            ArchiveNotEnabled = @()
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnableOnlineArchiving' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'EnableOnlineArchiving' -FieldValue $filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
index 99df96d1ca0c..1288147b8448 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
@@ -30,7 +30,6 @@ function Invoke-CIPPStandardEnablePronouns {
     #>
 
     param ($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'EnablePronouns'
 
     $Uri = 'https://graph.microsoft.com/v1.0/admin/people/pronouns'
     try {
@@ -38,7 +37,7 @@ function Invoke-CIPPStandardEnablePronouns {
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not get CurrentState for Pronouns. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
-        Return
+        return
     }
 
     if ($Settings.remediate -eq $true) {
@@ -70,7 +69,14 @@ function Invoke-CIPPStandardEnablePronouns {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnablePronouns' -FieldValue $CurrentState.isEnabledInOrganization -Tenant $tenant
+        $CurrentValue = [PSCustomObject]@{
+            EnablePronouns = $CurrentState.isEnabledInOrganization
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            EnablePronouns = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnablePronouns' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'PronounsEnabled' -FieldValue $CurrentState.isEnabledInOrganization -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1
index dc8ab4838108..5115ee7463b8 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1
@@ -51,9 +51,8 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations?`$expand=assignments&orderBy=priority&`$filter=deviceEnrollmentConfigurationType eq 'WindowsHelloForBusiness'" -tenantID $Tenant -AsApp $true |
-        Select-Object -Property id, pinMinimumLength, pinMaximumLength, pinUppercaseCharactersUsage, pinLowercaseCharactersUsage, pinSpecialCharactersUsage, state, securityDeviceRequired, unlockWithBiometricsEnabled, remotePassportEnabled, pinPreviousBlockCount, pinExpirationInDays, enhancedBiometricsState
-    }
-    catch {
+            Select-Object -Property id, pinMinimumLength, pinMaximumLength, pinUppercaseCharactersUsage, pinLowercaseCharactersUsage, pinSpecialCharactersUsage, state, securityDeviceRequired, unlockWithBiometricsEnabled, remotePassportEnabled, pinPreviousBlockCount, pinExpirationInDays, enhancedBiometricsState
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the EnrollmentWindowsHelloForBusinessConfiguration state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -87,11 +86,25 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration {
         enhancedBiometricsState     = $CurrentState.enhancedBiometricsState
     }
 
-    If ($Settings.remediate -eq $true) {
+    $ExpectedValue = [PSCustomObject]@{
+        pinMinimumLength            = $Settings.pinMinimumLength
+        pinMaximumLength            = $Settings.pinMaximumLength
+        pinUppercaseCharactersUsage = $Settings.pinUppercaseCharactersUsage.value
+        pinLowercaseCharactersUsage = $Settings.pinLowercaseCharactersUsage.value
+        pinSpecialCharactersUsage   = $Settings.pinSpecialCharactersUsage.value
+        state                       = $Settings.state.value
+        securityDeviceRequired      = $Settings.securityDeviceRequired
+        unlockWithBiometricsEnabled = $Settings.unlockWithBiometricsEnabled
+        remotePassportEnabled       = $Settings.remotePassportEnabled
+        pinPreviousBlockCount       = $Settings.pinPreviousBlockCount
+        pinExpirationInDays         = $Settings.pinExpirationInDays
+        enhancedBiometricsState     = $Settings.enhancedBiometricsState.value
+    }
+
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'EnrollmentWindowsHelloForBusinessConfiguration is already applied correctly.' -Sev Info
-        }
-        else {
+        } else {
             $cmdParam = @{
                 tenantid    = $Tenant
                 uri         = "https://graph.microsoft.com/beta/deviceManagement/deviceEnrollmentConfigurations/$($CurrentState.id)"
@@ -99,9 +112,9 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration {
                 Type        = 'PATCH'
                 ContentType = 'application/json; charset=utf-8'
                 Body        = [PSCustomObject]@{
-                    "@odata.type"             = "#microsoft.graph.deviceEnrollmentWindowsHelloForBusinessConfiguration"
-                    pinMinimumLength          = $Settings.pinMinimumLength
-                    pinMaximumLength          = $Settings.pinMaximumLength
+                    '@odata.type'               = '#microsoft.graph.deviceEnrollmentWindowsHelloForBusinessConfiguration'
+                    pinMinimumLength            = $Settings.pinMinimumLength
+                    pinMaximumLength            = $Settings.pinMaximumLength
                     pinUppercaseCharactersUsage = $Settings.pinUppercaseCharactersUsage.value
                     pinLowercaseCharactersUsage = $Settings.pinLowercaseCharactersUsage.value
                     pinSpecialCharactersUsage   = $Settings.pinSpecialCharactersUsage.value
@@ -117,8 +130,7 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration {
             try {
                 $null = New-GraphPostRequest @cmdParam
                 Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Successfully updated EnrollmentWindowsHelloForBusinessConfiguration.' -Sev Info
-            }
-            catch {
+            } catch {
                 $ErrorMessage = Get-CippException -Exception $_
                 Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Failed to update EnrollmentWindowsHelloForBusinessConfiguration. Error: $($ErrorMessage.NormalizedError)" -Sev Error
             }
@@ -126,18 +138,16 @@ function Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration {
 
     }
 
-    If ($Settings.alert -eq $true) {
+    if ($Settings.alert -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'EnrollmentWindowsHelloForBusinessConfiguration is correctly set.' -Sev Info
-        }
-        else {
+        } else {
             Write-StandardsAlert -message 'EnrollmentWindowsHelloForBusinessConfiguration is incorrectly set.' -object $CompareField -tenant $Tenant -standardName 'EnrollmentWindowsHelloForBusinessConfiguration' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'EnrollmentWindowsHelloForBusinessConfiguration is incorrectly set.' -Sev Info
         }
     }
 
-    If ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : $CompareField
-        Set-CIPPStandardsCompareField -FieldName 'standards.EnrollmentWindowsHelloForBusinessConfiguration' -FieldValue $FieldValue -TenantFilter $Tenant
+    if ($Settings.report -eq $true) {
+        Set-CIPPStandardsCompareField -FieldName 'standards.EnrollmentWindowsHelloForBusinessConfiguration' -CurrentValue $CompareField -ExpectedValue $ExpectedValue -TenantFilter $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1
index 9213b8324650..e40f07aabcc4 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1
@@ -34,34 +34,90 @@ function Invoke-CIPPStandardExchangeConnectorTemplate {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'ExConnector'
 
-    if ($Settings.remediate -eq $true) {
+    $Table = Get-CippTable -tablename 'templates'
+    $Filter = "PartitionKey eq 'ExConnectorTemplate'"
+    $AllConnectorTemplates = Get-CIPPAzDataTableEntity @Table -Filter $Filter
+    $TemplateIds = $Settings.exConnectorTemplate.value ?? $Settings.exConnectorTemplate
+    $Templates = $AllConnectorTemplates | Where-Object { $TemplateIds -contains $_.RowKey }
+    $Types = $Templates.direction | Sort-Object -Unique
+
+    $ExoBulkCommands = foreach ($Type in $Types) {
+        @{
+            CmdletInput = @{
+                CmdletName = "Get-$($Type)connector"
+                Parameters = @{}
+            }
+        }
+    }
+    $ExistingConnectors = New-ExoBulkRequest -tenantid $Tenant -cmdletArray @($ExoBulkCommands) -ReturnWithCommand $true
 
-        foreach ($Template in $Settings.TemplateList) {
+    if ($Settings.remediate -eq $true) {
+        foreach ($Template in $Templates) {
             try {
-                $Table = Get-CippTable -tablename 'templates'
-                $Filter = "PartitionKey eq 'ExConnectorTemplate' and RowKey eq '$($Template.value)'"
-                $connectorType = (Get-AzDataTableEntity @Table -Filter $Filter).direction
-                $RequestParams = (Get-AzDataTableEntity @Table -Filter $Filter).JSON | ConvertFrom-Json
+                $ConnectorType = $Template.direction
+                $RequestParams = $Template.JSON | ConvertFrom-Json
                 if ($RequestParams.comment) { $RequestParams.comment = Get-CIPPTextReplacement -Text $RequestParams.comment -TenantFilter $Tenant } else { $RequestParams | Add-Member -NotePropertyValue 'no comment' -NotePropertyName comment -Force }
-                $Existing = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $Tenant -cmdlet "Get-$($ConnectorType)connector" | Where-Object -Property Identity -EQ $RequestParams.name
+                $Existing = $ExistingConnectors.$("Get-$($ConnectorType)connector") | Where-Object -Property Identity -EQ $RequestParams.name
                 if ($Existing) {
                     $RequestParams | Add-Member -NotePropertyValue $Existing.Identity -NotePropertyName Identity -Force
                     $null = New-ExoRequest -tenantid $Tenant -cmdlet "Set-$($ConnectorType)connector" -cmdParams $RequestParams -useSystemMailbox $true
-                    Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated transport rule for $($Tenant, $Settings)" -sev info
+                    Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated transport rule $($RequestParams.name)" -sev info
                 } else {
                     $null = New-ExoRequest -tenantid $Tenant -cmdlet "New-$($ConnectorType)connector" -cmdParams $RequestParams -useSystemMailbox $true
-                    Write-LogMessage -API 'Standards' -tenant $Tenant -message "Created transport rule for $($Tenant, $Settings)" -sev info
+                    Write-LogMessage -API 'Standards' -tenant $Tenant -message "Created transport rule $($RequestParams.name)" -sev info
                 }
             } catch {
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
-                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to create or update Exchange Connector Rule: $ErrorMessage" -sev 'Error'
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to create or update Exchange Connector Rule: $ErrorMessage" -sev 'Error'
             }
-
         }
+    }
 
+    if ($Settings.alert -eq $true) {
+        foreach ($Template in $Templates) {
+            $ConnectorType = $Template.direction
+            $RequestParams = $Template.JSON | ConvertFrom-Json
+            $Existing = $ExistingConnectors.$("Get-$($ConnectorType)connector") | Where-Object -Property Identity -EQ $RequestParams.name
+            if (-not $Existing) {
+                Write-StandardsAlert -message "Exchange Connector Template '$($RequestParams.name)' of type '$($ConnectorType)' is not deployed" -object $RequestParams -tenant $Tenant -standardName 'ExchangeConnectorTemplate' -standardId $Settings.standardId
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "Exchange Connector Template '$($RequestParams.name)' of type '$($ConnectorType)' is not deployed" -sev Warning
+            } else {
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "Exchange Connector Template '$($RequestParams.name)' of type '$($ConnectorType)' is deployed" -sev Info
+            }
+        }
     }
 
+    if ($Settings.report -eq $true) {
+        # Extract expected connectors from templates
+        $ExpectedConnectors = foreach ($Template in $Templates) {
+            $TemplateParams = $Template.JSON | ConvertFrom-Json
+            [PSCustomObject]@{
+                Identity = $TemplateParams.name
+                Type     = $Template.direction
+            }
+        }
+
+        # Get matching deployed connectors
+        $DeployedConnectors = foreach ($ExpectedConnector in $ExpectedConnectors) {
+            $ConnectorType = $ExpectedConnector.Type
+            $ExistingConnector = $ExistingConnectors.$("Get-$($ConnectorType)connector") | Where-Object -Property Identity -EQ $ExpectedConnector.Identity
+            if ($ExistingConnector) {
+                [PSCustomObject]@{
+                    Identity = $ExistingConnector.Identity
+                    Type     = $ConnectorType
+                }
+            }
+        }
 
+        $CurrentValue = [PSCustomObject]@{
+            Connectors = @($DeployedConnectors)
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            Connectors = @($ExpectedConnectors)
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.ExchangeConnectorTemplates' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+        Add-CIPPBPAField -FieldName 'ExchangeConnectorTemplatesDeployed' -FieldValue ($DeployedConnectors.Identity) -StoreAs StringArray -Tenant $tenant
+    }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1
index 9924dc9cdf7b..8271da894f31 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1
@@ -31,8 +31,7 @@ function Invoke-CIPPStandardExcludedfileExt {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'ExcludedfileExt' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'ExcludedfileExt'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'ExcludedfileExt' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -41,8 +40,7 @@ function Invoke-CIPPStandardExcludedfileExt {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the ExcludedfileExt state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -61,7 +59,7 @@ function Invoke-CIPPStandardExcludedfileExt {
     Write-Host "MissingExclusions: $($MissingExclusions)"
 
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         # If the number of extensions in the settings does not match the number of extensions in the current settings, we need to update the settings
         $MissingExclusions = if ($Exts.Count -ne $CurrentInfo.excludedFileExtensionsForSyncApp.Count) { $true } else { $MissingExclusions }
@@ -92,8 +90,14 @@ function Invoke-CIPPStandardExcludedfileExt {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $MissingExclusions ? (@{ ext = $CurrentInfo.excludedFileExtensionsForSyncApp -join ',' }): $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.ExcludedfileExt' -FieldValue $state -Tenant $tenant
+        $CurrentValue = [PSCustomObject]@{
+            Extensions = @($CurrentInfo.excludedFileExtensionsForSyncApp)
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            Extensions = @($Exts)
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.ExcludedfileExt' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'ExcludedfileExt' -FieldValue $CurrentInfo.excludedFileExtensionsForSyncApp -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
index 719d1be1357a..f4d03b8edaeb 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
@@ -31,12 +31,10 @@ function Invoke-CIPPStandardExternalMFATrusted {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'ExternalMFATrusted'
 
     try {
         $ExternalMFATrusted = (New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/policies/crossTenantAccessPolicy/default?$select=inboundTrust' -tenantid $Tenant)
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the ExternalMFATrusted state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -47,8 +45,6 @@ function Invoke-CIPPStandardExternalMFATrusted {
     $WantedState = if ($state -eq 'true') { $true } else { $false }
     $StateMessage = if ($WantedState) { 'enabled' } else { 'disabled' }
 
-
-
     # Input validation
     if (([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message 'ExternalMFATrusted: Invalid state parameter set' -sev Error
@@ -73,10 +69,16 @@ function Invoke-CIPPStandardExternalMFATrusted {
             }
         }
     }
+
     if ($Settings.report -eq $true) {
-        $state = $ExternalMFATrusted.inboundTrust.isMfaAccepted ? $true : $ExternalMFATrusted.inboundTrust
-        $ReportState = $ExternalMFATrusted.inboundTrust.isMfaAccepted -eq $WantedState
-        Set-CIPPStandardsCompareField -FieldName 'standards.ExternalMFATrusted' -FieldValue $ReportState -TenantFilter $Tenant
+        $CurrentValue = @{
+            isMfaAccepted = $ExternalMFATrusted.inboundTrust.isMfaAccepted
+        }
+        $ExpectedValue = @{
+            isMfaAccepted = $WantedState
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.ExternalMFATrusted' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'ExternalMFATrusted' -FieldValue $ExternalMFATrusted.inboundTrust.isMfaAccepted -StoreAs bool -Tenant $Tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
index 4d668dbd3854..9c60877dd511 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
@@ -37,7 +37,6 @@ function Invoke-CIPPStandardFocusedInbox {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'FocusedInbox'
 
     # Get state value using null-coalescing operator
     $state = $Settings.state.value ?? $Settings.state
@@ -45,13 +44,12 @@ function Invoke-CIPPStandardFocusedInbox {
     # Input validation
     if ([string]::IsNullOrWhiteSpace($state) -or $state -eq 'Select a value') {
         Write-LogMessage -API 'Standards' -tenant $tenant -message 'ExternalMFATrusted: Invalid state parameter set' -sev Error
-        Return
+        return
     }
 
     try {
         $CurrentState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').FocusedInboxOn
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the FocusedInbox state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -77,7 +75,6 @@ function Invoke-CIPPStandardFocusedInbox {
     }
 
     if ($Settings.alert -eq $true) {
-
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Focused Inbox is set to $state." -sev Info
         } else {
@@ -87,8 +84,13 @@ function Invoke-CIPPStandardFocusedInbox {
     }
 
     if ($Settings.report -eq $true) {
-
-        Set-CIPPStandardsCompareField -FieldName 'standards.FocusedInbox' -FieldValue $StateIsCorrect -TenantFilter $Tenant
+        $CurrentValue = @{
+            FocusedInboxOn = $CurrentState
+        }
+        $ExpectedValue = @{
+            FocusedInboxOn = $WantedState
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.FocusedInbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'FocusedInboxCorrectState' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1
index 8c4598b93b57..957c2b2d7059 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1
@@ -44,7 +44,7 @@ function Invoke-CIPPStandardFormsPhishingProtection {
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not get current Forms settings. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
-        Return
+        return
     }
 
     if ($Settings.remediate -eq $true) {
@@ -82,7 +82,14 @@ function Invoke-CIPPStandardFormsPhishingProtection {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.FormsPhishingProtection' -FieldValue $CurrentState -Tenant $Tenant
+        $CurrentValue = @{
+            isInOrgFormsPhishingScanEnabled = $CurrentState
+        }
+        $ExpectedValue = @{
+            isInOrgFormsPhishingScanEnabled = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.FormsPhishingProtection' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'FormsPhishingProtection' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
index 1eff1e59ac2f..e7a3b9f246ea 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
@@ -27,9 +27,7 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications {
     .LINK
         https://docs.cipp.app/user-documentation/tenant/standards/list-standards
     #>
-
     param ($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'GlobalQuarantineNotifications'
     $TestResult = Test-CIPPStandardLicense -StandardName 'GlobalQuarantineNotifications' -TenantFilter $Tenant -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_S_STANDARD_GOV', 'EXCHANGE_S_ENTERPRISE_GOV', 'EXCHANGE_LITE') #No Foundation because that does not allow powershell access
 
     if ($TestResult -eq $false) {
@@ -39,9 +37,8 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications {
 
     try {
         $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-QuarantinePolicy' -cmdParams @{ QuarantinePolicyType = 'GlobalQuarantinePolicy' } |
-        Select-Object -ExcludeProperty '*data.type'
-    }
-    catch {
+            Select-Object -ExcludeProperty '*data.type'
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the GlobalQuarantineNotifications state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -102,8 +99,15 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications {
 
     if ($Settings.report -eq $true) {
         $notificationInterval = @{ NotificationInterval = "$(($CurrentState.EndUserSpamNotificationFrequency).TotalHours) hours" }
-        $ReportState = $CurrentState.EndUserSpamNotificationFrequency -eq $WantedState ? $true : $notificationInterval
-        Set-CIPPStandardsCompareField -FieldName 'standards.GlobalQuarantineNotifications' -FieldValue $ReportState -Tenant $Tenant
+
+        $CurrentValue = @{
+            EndUserSpamNotificationFrequency = $CurrentState.EndUserSpamNotificationFrequency
+        }
+        $ExpectedValue = @{
+            EndUserSpamNotificationFrequency = $WantedState
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.GlobalQuarantineNotifications' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'GlobalQuarantineNotificationsSet' -FieldValue [string]$CurrentState.EndUserSpamNotificationFrequency -StoreAs string -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1
index dae60252fc37..0024b7d7a5ee 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGroupTemplate.ps1
@@ -31,7 +31,6 @@ function Invoke-CIPPStandardGroupTemplate {
     #>
     param($Tenant, $Settings)
 
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'GroupTemplate'
     $existingGroups = New-GraphGETRequest -uri 'https://graph.microsoft.com/beta/groups?$top=999' -tenantid $tenant
 
     $TestResult = Test-CIPPStandardLicense -StandardName 'GroupTemplate' -TenantFilter $Tenant -RequiredCapabilities @('EXCHANGE_S_STANDARD', 'EXCHANGE_S_ENTERPRISE', 'EXCHANGE_LITE') -SkipLog
@@ -242,12 +241,15 @@ function Invoke-CIPPStandardGroupTemplate {
             }
         }
 
-        if ($MissingGroups.Count -eq 0) {
-            $fieldValue = $true
-        } else {
-            $fieldValue = $MissingGroups -join ', '
+        $CurrentValue = @{
+            ExistingGroups = $existingGroups.displayName
+            MissingGroups  = @($MissingGroups)
+        }
+        $ExpectedValue = @{
+            ExistingGroups = $GroupTemplates.displayName
+            MissingGroups  = @()
         }
 
-        Set-CIPPStandardsCompareField -FieldName 'standards.GroupTemplate' -FieldValue $fieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.GroupTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1
index 9a6762f5723a..30891463c9ae 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1
@@ -37,8 +37,7 @@ function Invoke-CIPPStandardGuestInvite {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the GuestInvite state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -48,7 +47,7 @@ function Invoke-CIPPStandardGuestInvite {
     $AllowInvitesFromValue = $Settings.allowInvitesFrom.value ?? $Settings.allowInvitesFrom
     if (([string]::IsNullOrWhiteSpace($AllowInvitesFromValue) -or $AllowInvitesFromValue -eq 'Select a value') -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
         Write-LogMessage -API 'Standards' -tenant $tenant -message 'GuestInvite: Invalid allowInvitesFrom parameter set' -sev Error
-        Return
+        return
     }
 
     $StateIsCorrect = ($CurrentState.allowInvitesFrom -eq $AllowInvitesFromValue)
@@ -87,8 +86,14 @@ function Invoke-CIPPStandardGuestInvite {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : ($CurrentState | Select-Object allowInvitesFrom)
-        Set-CIPPStandardsCompareField -FieldName 'standards.GuestInvite' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = @{
+            allowInvitesFrom = $CurrentState.allowInvitesFrom
+        }
+        $ExpectedValue = @{
+            allowInvitesFrom = $AllowInvitesFromValue
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.GuestInvite' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'GuestInvite' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1
index e306641d550d..06ab67ebb055 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1
@@ -41,9 +41,8 @@ function Invoke-CIPPStandardIntuneComplianceSettings {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceManagement/settings' -tenantid $Tenant |
-        Select-Object secureByDefault, deviceComplianceCheckinThresholdDays
-    }
-    catch {
+            Select-Object secureByDefault, deviceComplianceCheckinThresholdDays
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the intuneDeviceReg state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -93,8 +92,16 @@ function Invoke-CIPPStandardIntuneComplianceSettings {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.IntuneComplianceSettings' -FieldValue $state -Tenant $Tenant
+        $CurrentValue = @{
+            secureByDefault                      = $CurrentState.secureByDefault
+            deviceComplianceCheckinThresholdDays = $CurrentState.deviceComplianceCheckinThresholdDays
+        }
+        $ExpectedValue = @{
+            secureByDefault                      = $SecureByDefault
+            deviceComplianceCheckinThresholdDays = $DeviceComplianceCheckinThresholdDays
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.IntuneComplianceSettings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'IntuneComplianceSettings' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
index 4ba8ebbc353d..f3d7ccca4a0c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
@@ -37,7 +37,6 @@ function Invoke-CIPPStandardIntuneTemplate {
     #>
     param($Tenant, $Settings)
     $TestResult = Test-CIPPStandardLicense -StandardName 'IntuneTemplate_general' -TenantFilter $Tenant -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'intuneTemplate'
 
     if ($TestResult -eq $false) {
         #writing to each item that the license is not present.
@@ -94,42 +93,42 @@ function Invoke-CIPPStandardIntuneTemplate {
         if ($Compare) {
             Write-Host "IntuneTemplate: $($Template.TemplateList.value) - Compare found differences."
             [PSCustomObject]@{
-                MatchFailed            = $true
-                displayname            = $displayname
-                description            = $description
-                compare                = $Compare
-                rawJSON                = $RawJSON
-                body                   = $Request.body
-                assignTo               = $Template.AssignTo
-                excludeGroup           = $Template.excludeGroup
-                remediate              = $Template.remediate
-                alert                  = $Template.alert
-                report                 = $Template.report
-                existingPolicyId       = $ExistingPolicy.id
-                templateId             = $Template.TemplateList.value
-                customGroup            = $Template.customGroup
-                assignmentFilter       = $Template.assignmentFilter
-                assignmentFilterType   = $Template.assignmentFilterType
+                MatchFailed          = $true
+                displayname          = $displayname
+                description          = $description
+                compare              = $Compare
+                rawJSON              = $RawJSON
+                body                 = $Request.body
+                assignTo             = $Template.AssignTo
+                excludeGroup         = $Template.excludeGroup
+                remediate            = $Template.remediate
+                alert                = $Template.alert
+                report               = $Template.report
+                existingPolicyId     = $ExistingPolicy.id
+                templateId           = $Template.TemplateList.value
+                customGroup          = $Template.customGroup
+                assignmentFilter     = $Template.assignmentFilter
+                assignmentFilterType = $Template.assignmentFilterType
             }
         } else {
             Write-Host "IntuneTemplate: $($Template.TemplateList.value) - No differences found."
             [PSCustomObject]@{
-                MatchFailed            = $false
-                displayname            = $displayname
-                description            = $description
-                compare                = $false
-                rawJSON                = $RawJSON
-                body                   = $Request.body
-                assignTo               = $Template.AssignTo
-                excludeGroup           = $Template.excludeGroup
-                remediate              = $Template.remediate
-                alert                  = $Template.alert
-                report                 = $Template.report
-                existingPolicyId       = $ExistingPolicy.id
-                templateId             = $Template.TemplateList.value
-                customGroup            = $Template.customGroup
-                assignmentFilter       = $Template.assignmentFilter
-                assignmentFilterType   = $Template.assignmentFilterType
+                MatchFailed          = $false
+                displayname          = $displayname
+                description          = $description
+                compare              = $false
+                rawJSON              = $RawJSON
+                body                 = $Request.body
+                assignTo             = $Template.AssignTo
+                excludeGroup         = $Template.excludeGroup
+                remediate            = $Template.remediate
+                alert                = $Template.alert
+                report               = $Template.report
+                existingPolicyId     = $ExistingPolicy.id
+                templateId           = $Template.TemplateList.value
+                customGroup          = $Template.customGroup
+                assignmentFilter     = $Template.assignmentFilter
+                assignmentFilterType = $Template.assignmentFilterType
             }
         }
     }
@@ -140,15 +139,15 @@ function Invoke-CIPPStandardIntuneTemplate {
             Write-Host "working on template deploy: $($TemplateFile.displayname)"
             try {
                 $TemplateFile.customGroup ? ($TemplateFile.AssignTo = $TemplateFile.customGroup) : $null
-                
+
                 $PolicyParams = @{
-                    TemplateType  = $TemplateFile.body.Type
-                    Description   = $TemplateFile.description
-                    DisplayName   = $TemplateFile.displayname
-                    RawJSON       = $templateFile.rawJSON
-                    AssignTo      = $TemplateFile.AssignTo
-                    ExcludeGroup  = $TemplateFile.excludeGroup
-                    tenantFilter  = $Tenant
+                    TemplateType = $TemplateFile.body.Type
+                    Description  = $TemplateFile.description
+                    DisplayName  = $TemplateFile.displayname
+                    RawJSON      = $templateFile.rawJSON
+                    AssignTo     = $TemplateFile.AssignTo
+                    ExcludeGroup = $TemplateFile.excludeGroup
+                    tenantFilter = $Tenant
                 }
 
                 # Add assignment filter if specified
@@ -188,9 +187,18 @@ function Invoke-CIPPStandardIntuneTemplate {
         foreach ($Template in $CompareList | Where-Object { $_.report -eq $true -or $_.remediate -eq $true }) {
             Write-Host "working on template report: $($Template.displayname)"
             $id = $Template.templateId
-            $CompareObj = $Template.compare
-            $state = $CompareObj ? $CompareObj : $true
-            Set-CIPPStandardsCompareField -FieldName "standards.IntuneTemplate.$id" -FieldValue $state -TenantFilter $Tenant
+
+            $CurrentValue = @{
+                displayName = $Template.displayname
+                description = $Template.description
+                isCompliant = if ($Template.compare) { $false } else { $true }
+            }
+            $ExpectedValue = @{
+                displayName = $Template.displayname
+                description = $Template.description
+                isCompliant = $true
+            }
+            Set-CIPPStandardsCompareField -FieldName "standards.IntuneTemplate.$id" -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         }
         #Add-CIPPBPAField -FieldName "policy-$id" -FieldValue $Compare -StoreAs bool -Tenant $tenant
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1
index 2cca54b4929f..899677c80a05 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1
@@ -34,22 +34,21 @@ function Invoke-CIPPStandardLegacyEmailReportAddins {
     # Define the legacy add-ins to remove
     $LegacyAddins = @(
         @{
-            AssetId = 'WA200002469'
+            AssetId   = 'WA200002469'
             ProductId = '3f32746a-0586-4c54-b8ce-d3b611c5b6c8'
-            Name = 'Report Phishing'
+            Name      = 'Report Phishing'
         },
         @{
-            AssetId = 'WA104381180'
+            AssetId   = 'WA104381180'
             ProductId = '6046742c-3aee-485e-a4ac-92ab7199db2e'
-            Name = 'Report Message'
+            Name      = 'Report Message'
         }
     )
 
     try {
         $CurrentApps = New-GraphGetRequest -scope 'https://admin.microsoft.com/.default' -TenantID $Tenant -Uri 'https://admin.microsoft.com/fd/addins/api/apps?workloads=AzureActiveDirectory,WXPO,MetaOS,Teams,SharePoint'
         $InstalledApps = $CurrentApps.apps
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the installed add-ins for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -64,11 +63,11 @@ function Invoke-CIPPStandardLegacyEmailReportAddins {
         if ($InstalledAddin) {
             $InstalledLegacyAddins.Add($LegacyAddin.Name)
             $AddinsToRemove.Add([PSCustomObject]@{
-                AppsourceAssetID = $LegacyAddin.AssetId
-                ProductID = $LegacyAddin.ProductId
-                Command = 'UNDEPLOY'
-                Workload = 'WXPO'
-            })
+                    AppsourceAssetID = $LegacyAddin.AssetId
+                    ProductID        = $LegacyAddin.ProductId
+                    Command          = 'UNDEPLOY'
+                    Workload         = 'WXPO'
+                })
         }
     }
 
@@ -82,18 +81,18 @@ function Invoke-CIPPStandardLegacyEmailReportAddins {
             foreach ($AddinToRemove in $AddinsToRemove) {
                 try {
                     $Body = @{
-                        Locale = 'en-US'
+                        Locale                 = 'en-US'
                         WorkloadManagementList = @($AddinToRemove)
                     } | ConvertTo-Json -Depth 10 -Compress
 
                     $GraphRequest = @{
-                        tenantID = $Tenant
-                        uri = 'https://admin.microsoft.com/fd/addins/api/apps'
-                        scope = 'https://admin.microsoft.com/.default'
-                        AsApp = $false
-                        Type = 'POST'
+                        tenantID    = $Tenant
+                        uri         = 'https://admin.microsoft.com/fd/addins/api/apps'
+                        scope       = 'https://admin.microsoft.com/.default'
+                        AsApp       = $false
+                        Type        = 'POST'
                         ContentType = 'application/json; charset=utf-8'
-                        Body = $Body
+                        Body        = $Body
                     }
 
                     $Response = New-GraphPostRequest @GraphRequest
@@ -126,8 +125,7 @@ function Invoke-CIPPStandardLegacyEmailReportAddins {
             # Use fresh state for reporting/alerting
             $StateIsCorrect = ($FreshInstalledLegacyAddins.Count -eq 0)
             $InstalledLegacyAddins = $FreshInstalledLegacyAddins
-        }
-        catch {
+        } catch {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get fresh add-in state after remediation for $Tenant" -Sev Warning
         }
     }
@@ -143,15 +141,14 @@ function Invoke-CIPPStandardLegacyEmailReportAddins {
     }
 
     if ($Settings.report -eq $true) {
-        $ReportData = if ($StateIsCorrect) {
-            $true
-        } else {
-            @{
-                InstalledLegacyAddins = $InstalledLegacyAddins
-                Status = 'Legacy add-ins still installed'
-            }
+        $CurrentValue = @{
+            InstalledLegacyAddins = $InstalledLegacyAddins
+        }
+        $ExpectedValue = @{
+            InstalledLegacyAddins = @()
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.LegacyEmailReportAddins' -FieldValue $ReportData -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'LegacyEmailReportAddins' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.LegacyEmailReportAddins' -Tenant $Tenant -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue
+        Add-CIPPBPAField -FieldName 'LegacyEmailReportAddins' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1
index c1ee03aecaa5..250aaa273045 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1
@@ -83,8 +83,13 @@
     }
 
     if ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : @{isMdmEnrollmentDuringRegistrationDisabled = $CurrentState; desiredState = $DesiredState }
-        Set-CIPPStandardsCompareField -FieldName 'standards.MDMEnrollmentDuringRegistration' -FieldValue $FieldValue -TenantFilter $Tenant
+        $CurrentValue = @{
+            isMdmEnrollmentDuringRegistrationDisabled = $CurrentState
+        }
+        $ExpectedValue = @{
+            isMdmEnrollmentDuringRegistrationDisabled = $DesiredState
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.MDMEnrollmentDuringRegistration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'MDMEnrollmentDuringRegistration' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMScope.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
index 5566af2f0c46..b0e67306cc6a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
@@ -41,18 +41,17 @@ function Invoke-CIPPStandardMDMScope {
 
     try {
         $CurrentInfo = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/mobileDeviceManagementPolicies/0000000a-0000-0000-c000-000000000000?$expand=includedGroups' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the MDM Scope state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
     $StateIsCorrect = ($CurrentInfo.termsOfUseUrl -eq 'https://portal.manage.microsoft.com/TermsofUse.aspx') -and
-        ($CurrentInfo.discoveryUrl -eq 'https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc') -and
-        ($CurrentInfo.complianceUrl -eq 'https://portal.manage.microsoft.com/?portalAction=Compliance') -and
-        ($CurrentInfo.appliesTo -eq $Settings.appliesTo) -and
-        ($Settings.appliesTo -ne 'selected' -or ($CurrentInfo.includedGroups.displayName -contains $Settings.customGroup))
+    ($CurrentInfo.discoveryUrl -eq 'https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc') -and
+    ($CurrentInfo.complianceUrl -eq 'https://portal.manage.microsoft.com/?portalAction=Compliance') -and
+    ($CurrentInfo.appliesTo -eq $Settings.appliesTo) -and
+    ($Settings.appliesTo -ne 'selected' -or ($CurrentInfo.includedGroups.displayName -contains $Settings.customGroup))
 
     $CompareField = [PSCustomObject]@{
         termsOfUseUrl = $CurrentInfo.termsOfUseUrl
@@ -62,7 +61,7 @@ function Invoke-CIPPStandardMDMScope {
         customGroup   = $CurrentInfo.includedGroups.displayName
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'MDM Scope already correctly configured' -sev Info
         } else {
@@ -144,8 +143,21 @@ function Invoke-CIPPStandardMDMScope {
     }
 
     if ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : $CompareField
-        Set-CIPPStandardsCompareField -FieldName 'standards.MDMScope' -FieldValue $FieldValue -TenantFilter $Tenant
+        $CurrentValue = @{
+            termsOfUseUrl = $CurrentInfo.termsOfUseUrl
+            discoveryUrl  = $CurrentInfo.discoveryUrl
+            complianceUrl = $CurrentInfo.complianceUrl
+            appliesTo     = $CurrentInfo.appliesTo
+            customGroup   = $CurrentInfo.includedGroups.displayName
+        }
+        $ExpectedValue = @{
+            termsOfUseUrl = $Settings.termsOfUseUrl
+            discoveryUrl  = $Settings.discoveryUrl
+            complianceUrl = $Settings.complianceUrl
+            appliesTo     = $Settings.appliesTo
+            customGroup   = $Settings.customGroup
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.MDMScope' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'MDMScope' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
index 0c255ecfa1d6..d45e345f556c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
@@ -34,7 +34,6 @@ function Invoke-CIPPStandardMailContacts {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'MailContacts'
 
     try {
         $TenantID = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/organization' -tenantid $tenant)
@@ -107,8 +106,17 @@ function Invoke-CIPPStandardMailContacts {
 
     }
     if ($Settings.report -eq $true) {
-        $ReportState = $state ? $true : ($CurrentInfo | Select-Object marketingNotificationEmails, technicalNotificationMails, privacyProfile)
-        Set-CIPPStandardsCompareField -FieldName 'standards.MailContacts' -FieldValue $ReportState -Tenant $tenant
+        $CurrentValue = @{
+            marketingNotificationEmails = $CurrentInfo.marketingNotificationEmails
+            technicalNotificationMails  = @($CurrentInfo.technicalNotificationMails)
+            contactEmail                = $CurrentInfo.privacyProfile.contactEmail
+        }
+        $ExpectedValue = @{
+            marketingNotificationEmails = $Contacts.MarketingContact
+            technicalNotificationMails  = @($Contacts.SecurityContact, $Contacts.TechContact) | Where-Object { $_ -ne $null }
+            contactEmail                = $Contacts.GeneralContact
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.MailContacts' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
         Add-CIPPBPAField -FieldName 'MailContacts' -FieldValue $CurrentInfo -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1
index 72e7b220962b..a796462e2881 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1
@@ -48,8 +48,7 @@ function Invoke-CIPPStandardMailboxRecipientLimits {
     # Get mailbox plans first
     try {
         $MailboxPlans = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-MailboxPlan' -cmdParams @{ ResultSize = 'Unlimited' }
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the MailboxRecipientLimits state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -259,11 +258,14 @@ function Invoke-CIPPStandardMailboxRecipientLimits {
         }
         Add-CIPPBPAField -FieldName 'MailboxRecipientLimits' -FieldValue $ReportData -StoreAs json -Tenant $Tenant
 
-        if ($MailboxesToUpdate.Count -eq 0 -and $MailboxesWithPlanIssues.Count -eq 0) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $ReportData
+        $CurrentValue = @{
+            MailboxesToUpdate       = @($MailboxesToUpdate)
+            MailboxesWithPlanIssues = @($MailboxesWithPlanIssues)
+        }
+        $ExpectedValue = @{
+            MailboxesToUpdate       = @()
+            MailboxesWithPlanIssues = @()
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.MailboxRecipientLimits' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.MailboxRecipientLimits' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
index 22c3f53fde45..640db0445b43 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
@@ -49,7 +49,6 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'MalwareFilterPolicy'
 
     # Use custom name if provided, otherwise use default for backward compatibility
     $PolicyName = if ($Settings.name) { $Settings.name } else { 'CIPP Default Malware Policy' }
@@ -193,8 +192,21 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.MalwareFilterPolicy' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = $CurrentState | Select-Object Name, EnableFileFilter, FileTypeAction, FileTypes, ZapEnabled, QuarantineTag, EnableInternalSenderAdminNotifications, InternalSenderAdminAddress, EnableExternalSenderAdminNotifications, ExternalSenderAdminAddress
+
+        $ExpectedValue = @{
+            Name                                   = $PolicyName
+            EnableFileFilter                       = $true
+            FileTypeAction                         = $FileTypeAction
+            FileTypes                              = $ExpectedFileTypes
+            ZapEnabled                             = $true
+            QuarantineTag                          = $Settings.QuarantineTag
+            EnableInternalSenderAdminNotifications = $Settings.EnableInternalSenderAdminNotifications
+            InternalSenderAdminAddress             = $Settings.InternalSenderAdminAddress
+            EnableExternalSenderAdminNotifications = $Settings.EnableExternalSenderAdminNotifications
+            ExternalSenderAdminAddress             = $Settings.ExternalSenderAdminAddress
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.MalwareFilterPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'MalwareFilterPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1
index b3d2e22adb6d..489366c54f0a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1
@@ -34,12 +34,10 @@ function Invoke-CIPPStandardMessageExpiration {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'MessageExpiration'
 
     try {
         $MessageExpiration = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-TransportConfig').messageExpiration
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the MessageExpiration state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -70,8 +68,13 @@ function Invoke-CIPPStandardMessageExpiration {
         }
     }
     if ($Settings.report -eq $true) {
-        if ($MessageExpiration -ne '12:00:00') { $MessageExpiration = $false } else { $MessageExpiration = $true }
-        Set-CIPPStandardsCompareField -FieldName 'standards.MessageExpiration' -FieldValue $MessageExpiration -TenantFilter $Tenant
+        $CurrentValue = @{
+            MessageExpiration = $MessageExpiration
+        }
+        $ExpectedValue = @{
+            MessageExpiration = '12:00:00'
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.MessageExpiration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'messageExpiration' -FieldValue $MessageExpiration -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
index e81fc47ee558..169ba51d7586 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
@@ -32,7 +32,6 @@ function Invoke-CIPPStandardNudgeMFA {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'NudgeMFA'
     Write-Host "NudgeMFA: $($Settings | ConvertTo-Json -Compress)"
     # Get state value using null-coalescing operator
     $State = $Settings.state.value ?? $Settings.state
@@ -86,8 +85,15 @@ function Invoke-CIPPStandardNudgeMFA {
     }
 
     if ($Settings.report -eq $true) {
-        $State = $StateIsCorrect ? $true : ($CurrentState.registrationEnforcement.authenticationMethodsRegistrationCampaign | Select-Object snoozeDurationInDays, state)
-        Set-CIPPStandardsCompareField -FieldName 'standards.NudgeMFA' -FieldValue $State -Tenant $Tenant
+        $CurrentValue = @{
+            snoozeDurationInDays = $CurrentState.registrationEnforcement.authenticationMethodsRegistrationCampaign.snoozeDurationInDays
+            state                = $CurrentState.registrationEnforcement.authenticationMethodsRegistrationCampaign.state
+        }
+        $ExpectedValue = @{
+            snoozeDurationInDays = $Settings.snoozeDurationInDays
+            state                = $State
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.NudgeMFA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'NudgeMFA' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1
index d63acb07b749..614df8aca6fe 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1
@@ -119,19 +119,18 @@ function Invoke-CIPPStandardOWAAttachmentRestrictions {
     }
 
     if ($Settings.report -eq $true) {
-        if ($StateIsCorrect) {
-            Set-CIPPStandardsCompareField -FieldName 'standards.OWAAttachmentRestrictions' -FieldValue $true -TenantFilter $Tenant
-            Add-CIPPBPAField -FieldName 'OWAAttachmentRestrictions' -FieldValue $true -StoreAs bool -Tenant $Tenant
-        } else {
-            $ReportData = @{
-                CurrentPolicy  = $CurrentPolicy.ConditionalAccessPolicy
-                RequiredPolicy = $Settings.ConditionalAccessPolicy.value
-                PolicyName     = $CurrentPolicy.Name
-                IsCompliant    = $false
-                Description    = 'OWA attachment restrictions not properly configured for unmanaged devices'
-            }
-            Set-CIPPStandardsCompareField -FieldName 'standards.OWAAttachmentRestrictions' -FieldValue $ReportData -TenantFilter $Tenant
-            Add-CIPPBPAField -FieldName 'OWAAttachmentRestrictions' -FieldValue $ReportData -StoreAs json -Tenant $Tenant
+        $CurrentValue = @{
+            ConditionalAccessPolicy = $CurrentPolicy.ConditionalAccessPolicy
+            PolicyName              = $CurrentPolicy.Name
+            IsCompliant             = $StateIsCorrect
         }
+        $ExpectedValue = @{
+            ConditionalAccessPolicy = $Settings.ConditionalAccessPolicy.value
+            PolicyName              = 'OwaMailboxPolicy-Default'
+            IsCompliant             = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.OWAAttachmentRestrictions' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+        Add-CIPPBPAField -FieldName 'OWAAttachmentRestrictions' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
index 3c26e522a553..d4eee69db7a6 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
@@ -42,8 +42,7 @@ function Invoke-CIPPStandardOauthConsent {
 
     try {
         $State = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the OauthConsent state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -101,12 +100,12 @@ function Invoke-CIPPStandardOauthConsent {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'OauthConsent' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $State | Select-Object -Property permissionGrantPolicyIdsAssignedToDefaultUserRole
+        $CurrentValue = @{
+            permissionGrantPolicyIdsAssignedToDefaultUserRole = $State.permissionGrantPolicyIdsAssignedToDefaultUserRole
         }
-
-        Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsent' -FieldValue $FieldValue -Tenant $tenant
+        $ExpectedValue = @{
+            permissionGrantPolicyIdsAssignedToDefaultUserRole = @('managePermissionGrantsForSelf.cipp-consent-policy')
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsent' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1
index 89a4336b0d84..2ba180c1a0ca 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1
@@ -35,9 +35,8 @@ function Invoke-CIPPStandardOauthConsentLowSec {
         $State = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy' -tenantid $tenant)
 
         $PermissionState = (New-GraphGetRequest -Uri "https://graph.microsoft.com/beta/servicePrincipals(appId='00000003-0000-0000-c000-000000000000')/delegatedPermissionClassifications" -tenantid $tenant) |
-        Select-Object -Property permissionName
-    }
-    catch {
+            Select-Object -Property permissionName
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the OauthConsentLowSec state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -108,23 +107,21 @@ function Invoke-CIPPStandardOauthConsentLowSec {
     }
 
     if ($Settings.report -eq $true) {
-        if ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -notin @('managePermissionGrantsForSelf.microsoft-user-default-low')) {
-            $State.permissionGrantPolicyIdsAssignedToDefaultUserRole = $false
-            $ValueField = @{
-                authorizationPolicy       = $State.permissionGrantPolicyIdsAssignedToDefaultUserRole
-                permissionClassifications = $PermissionState
-            }
-            if ($ConflictingStandard) {
-                $ValueField.conflictingStandard = @{
-                    name       = $ConflictingStandard.Standard
-                    templateid = $ConflictingStandard.TemplateId
-                }
+        $CurrentValue = @{
+            permissionGrantPolicyIdsAssignedToDefaultUserRole = $State.permissionGrantPolicyIdsAssignedToDefaultUserRole
+        }
+        # Add conflicting standard info if applicable
+        if ($ConflictingStandard) {
+            $CurrentValue.conflictingStandard = @{
+                name       = $ConflictingStandard.Standard
+                templateid = $ConflictingStandard.TemplateId
             }
-        } else {
-            $State.permissionGrantPolicyIdsAssignedToDefaultUserRole = $true
-            $ValueField = $true
+        }
+
+        $ExpectedValue = @{
+            permissionGrantPolicyIdsAssignedToDefaultUserRole = @('managePermissionGrantsForSelf.microsoft-user-default-low')
         }
         Add-CIPPBPAField -FieldName 'OauthConsentLowSec' -FieldValue $State.permissionGrantPolicyIdsAssignedToDefaultUserRole -StoreAs bool -Tenant $tenant
-        Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsentLowSec' -FieldValue $ValueField -Tenant $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsentLowSec' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1
index 3407c342634c..746cb2632c46 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1
@@ -40,8 +40,7 @@ function Invoke-CIPPStandardOutBoundSpamAlert {
 
     try {
         $CurrentInfo = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-HostedOutboundSpamFilterPolicy' -cmdParams @{ Identity = 'Default' } -useSystemMailbox $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the OutBoundSpamAlert state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -76,11 +75,14 @@ function Invoke-CIPPStandardOutBoundSpamAlert {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'OutboundSpamAlert' -FieldValue $CurrentInfo.NotifyOutboundSpam -StoreAs bool -Tenant $tenant
-        if ($CurrentInfo.NotifyOutboundSpam -ne $true -or $CurrentInfo.NotifyOutboundSpamRecipients -ne $settings.OutboundSpamContact) {
-            $ValueField = $CurrentInfo | Select-Object -Property NotifyOutboundSpamRecipients, NotifyOutboundSpam
-        } else {
-            $ValueField = $true
+        $CurrentValue = @{
+            NotifyOutboundSpam           = $CurrentInfo.NotifyOutboundSpam
+            NotifyOutboundSpamRecipients = $CurrentInfo.NotifyOutboundSpamRecipients
+        }
+        $ExpectedValue = @{
+            NotifyOutboundSpam           = $true
+            NotifyOutboundSpamRecipients = $settings.OutboundSpamContact
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.OutBoundSpamAlert' -FieldValue $ValueField -Tenant $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.OutBoundSpamAlert' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
index cfc78fe70b03..474de9cf7e44 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
@@ -102,6 +102,12 @@ function Invoke-CIPPStandardPWcompanionAppAllowedState {
         } else {
             $FieldValue = $AuthenticatorFeaturesState.featureSettings.companionAppAllowedState
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.PWcompanionAppAllowedState' -FieldValue $FieldValue -Tenant $Tenant
+        $CurrentValue = @{
+            companionAppAllowedState = $AuthenticatorFeaturesState.featureSettings.companionAppAllowedState.state
+        }
+        $ExpectedValue = @{
+            companionAppAllowedState = $WantedState
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.PWcompanionAppAllowedState' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
index 05a71918a8c2..63723ed0fd13 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
@@ -42,8 +42,7 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/microsoftAuthenticator' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the PWdisplayAppInformationRequiredState state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -75,11 +74,16 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'PWdisplayAppInformationRequiredState' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            state                              = $CurrentState.state
+            numberMatchingRequiredState        = $CurrentState.featureSettings.numberMatchingRequiredState.state
+            displayAppInformationRequiredState = $CurrentState.featureSettings.displayAppInformationRequiredState.state
+        }
+        $ExpectedValue = @{
+            state                              = 'enabled'
+            numberMatchingRequiredState        = 'enabled'
+            displayAppInformationRequiredState = 'enabled'
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.PWdisplayAppInformationRequiredState' -FieldValue $FieldValue -Tenant $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.PWdisplayAppInformationRequiredState' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
index b26f7ba9b84c..403f80236b2e 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
@@ -37,8 +37,7 @@ function Invoke-CIPPStandardPasswordExpireDisabled {
 
     try {
         $GraphRequest = New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/domains' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the PasswordExpireDisabled state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -82,11 +81,13 @@ function Invoke-CIPPStandardPasswordExpireDisabled {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'PasswordExpireDisabled' -FieldValue $DomainsWithoutPassExpire -StoreAs json -Tenant $tenant
-        if ($DomainsWithoutPassExpire) {
-            $FieldValue = $DomainsWithoutPassExpire
-        } else {
-            $FieldValue = $true
+
+        $CurrentValue = @{
+            DomainsWithoutPassExpire = @($DomainsWithoutPassExpire)
+        }
+        $ExpectedValue = @{
+            DomainsWithoutPassExpire = @()
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.PasswordExpireDisabled' -FieldValue $FieldValue -Tenant $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.PasswordExpireDisabled' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
index 32cfa2b62748..e4ea97dc4389 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
@@ -42,15 +42,14 @@ function Invoke-CIPPStandardPerUserMFA {
 
     try {
         $GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=999&`$select=userPrincipalName,displayName,accountEnabled,perUserMfaState&`$filter=userType eq 'Member' and accountEnabled eq true and displayName ne 'On-Premises Directory Synchronization Service Account'&`$count=true" -tenantid $Tenant -ComplexFilter
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the PerUserMFA state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $UsersWithoutMFA = $GraphRequest | Where-Object -Property perUserMfaState -NE 'enforced' | Select-Object -Property userPrincipalName, displayName, accountEnabled, perUserMfaState
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if (($UsersWithoutMFA | Measure-Object).Count -gt 0) {
             try {
                 $MFAMessage = Set-CIPPPerUserMFA -TenantFilter $Tenant -userId @($UsersWithoutMFA.userPrincipalName) -State 'enforced'
@@ -70,8 +69,13 @@ function Invoke-CIPPStandardPerUserMFA {
         }
     }
     if ($Settings.report -eq $true) {
-        $State = $UsersWithoutMFA ? $UsersWithoutMFA : $true
-        Set-CIPPStandardsCompareField -FieldName 'standards.PerUserMFA' -FieldValue $State -Tenant $tenant
+        $CurrentValue = @{
+            UsersWithoutMFA = @($UsersWithoutMFA)
+        }
+        $ExpectedValue = @{
+            UsersWithoutMFA = @()
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.PerUserMFA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
         Add-CIPPBPAField -FieldName 'LegacyMFAUsers' -FieldValue $UsersWithoutMFA -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1
index ee3093fbd9c9..fdf203641250 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1
@@ -33,7 +33,6 @@ function Invoke-CIPPStandardPhishProtection {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'PhishProtection'
 
     $TenantId = Get-Tenants | Where-Object -Property defaultDomainName -EQ $tenant
 
@@ -100,7 +99,13 @@ function Invoke-CIPPStandardPhishProtection {
     }
     if ($Settings.report -eq $true) {
         if ($currentBody -like "*$CSS*") { $authState = $true } else { $authState = $false }
+        $CurrentValue = @{
+            PhishingCSSEnabled = $authState
+        }
+        $ExpectedValue = @{
+            PhishingCSSEnabled = $true
+        }
         Add-CIPPBPAField -FieldName 'PhishProtection' -FieldValue $authState -StoreAs bool -Tenant $tenant
-        Set-CIPPStandardsCompareField -FieldName 'standards.PhishProtection' -FieldValue $authState -Tenant $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.PhishProtection' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1
index 23691f879c08..8374e9803f06 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1
@@ -39,9 +39,8 @@ function Invoke-CIPPStandardPhishSimSpoofIntelligence {
     # Fetch current Phishing Simulations Spoof Intelligence domains and ensure it is correctly configured
     try {
         $DomainState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-TenantAllowBlockListSpoofItems' |
-        Select-Object -Property Identity, SendingInfrastructure
-    }
-    catch {
+            Select-Object -Property Identity, SendingInfrastructure
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the PhishSimSpoofIntelligence state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -51,7 +50,7 @@ function Invoke-CIPPStandardPhishSimSpoofIntelligence {
 
     if ($Settings.RemoveExtraDomains -eq $true) {
         $RemoveDomain = $DomainState | Where-Object { $_.SendingInfrastructure -notin $Settings.AllowedDomains.value } |
-            Select-Object -Property Identity,SendingInfrastructure
+            Select-Object -Property Identity, SendingInfrastructure
     } else {
         $RemoveDomain = @()
     }
@@ -59,19 +58,19 @@ function Invoke-CIPPStandardPhishSimSpoofIntelligence {
     $StateIsCorrect = ($AddDomain.Count -eq 0 -and $RemoveDomain.Count -eq 0)
 
     $CompareField = [PSCustomObject]@{
-        "Missing Domains"   = $AddDomain -join ', '
-        "Incorrect Domains" = $RemoveDomain.SendingInfrastructure -join ', '
+        'Missing Domains'   = $AddDomain -join ', '
+        'Incorrect Domains' = $RemoveDomain.SendingInfrastructure -join ', '
     }
 
-    If ($Settings.remediate -eq $true) {
-        If ($StateIsCorrect -eq $true) {
+    if ($Settings.remediate -eq $true) {
+        if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Spoof Intelligence Allow list already correctly configured' -sev Info
-        } Else {
+        } else {
             $BulkRequests = New-Object System.Collections.Generic.List[Hashtable]
 
             if ($Settings.RemoveExtraDomains -eq $true) {
                 # Prepare removal requests
-                If ($RemoveDomain.Count -gt 0) {
+                if ($RemoveDomain.Count -gt 0) {
                     Write-Host "Removing $($RemoveDomain.Count) domains from Spoof Intelligence"
                     $BulkRequests.Add(@{
                             CmdletInput = @{
@@ -83,45 +82,52 @@ function Invoke-CIPPStandardPhishSimSpoofIntelligence {
             }
 
             # Prepare addition requests
-            ForEach ($Domain in $AddDomain) {
+            foreach ($Domain in $AddDomain) {
                 $BulkRequests.Add(@{
-                    CmdletInput = @{
-                        CmdletName = 'New-TenantAllowBlockListSpoofItems'
-                        Parameters = @{ Identity = 'default'; Action = 'Allow'; SendingInfrastructure = $Domain; SpoofedUser = '*'; SpoofType = 'Internal' }
-                    }
-                })
+                        CmdletInput = @{
+                            CmdletName = 'New-TenantAllowBlockListSpoofItems'
+                            Parameters = @{ Identity = 'default'; Action = 'Allow'; SendingInfrastructure = $Domain; SpoofedUser = '*'; SpoofType = 'Internal' }
+                        }
+                    })
                 $BulkRequests.Add(@{
-                    CmdletInput = @{
-                        CmdletName = 'New-TenantAllowBlockListSpoofItems'
-                        Parameters = @{ Identity = 'default'; Action = 'Allow'; SendingInfrastructure = $Domain; SpoofedUser = '*'; SpoofType = 'External' }
-                    }
-                })
+                        CmdletInput = @{
+                            CmdletName = 'New-TenantAllowBlockListSpoofItems'
+                            Parameters = @{ Identity = 'default'; Action = 'Allow'; SendingInfrastructure = $Domain; SpoofedUser = '*'; SpoofType = 'External' }
+                        }
+                    })
             }
             $RawExoRequest = New-ExoBulkRequest -tenantid $Tenant -cmdletArray @($BulkRequests)
 
             $LastError = $RawExoRequest | Select-Object -Last 1
-            If ($LastError.error) {
-                Foreach ($ExoError in $LastError.error) {
+            if ($LastError.error) {
+                foreach ($ExoError in $LastError.error) {
                     Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Failed to process Spoof Intelligence Domain with error: $ExoError" -Sev Error
                 }
-            } Else {
-                Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Processed all Spoof Intelligence Domains successfully." -Sev Info
+            } else {
+                Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'Processed all Spoof Intelligence Domains successfully.' -Sev Info
             }
         }
     }
 
-    If ($Settings.alert -eq $true) {
-        If ($StateIsCorrect -eq $true) {
+    if ($Settings.alert -eq $true) {
+        if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Spoof Intelligence Allow list is correctly configured' -sev Info
-        } Else {
+        } else {
             Write-StandardsAlert -message 'Spoof Intelligence Allow list is not correctly configured' -object $CompareField -tenant $Tenant -standardName 'PhishSimSpoofIntelligence' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Spoof Intelligence Allow list is not correctly configured' -sev Info
         }
     }
 
-    If ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : $CompareField
-        Set-CIPPStandardsCompareField -FieldName 'standards.PhishSimSpoofIntelligence' -FieldValue $FieldValue -Tenant $Tenant
+    if ($Settings.report -eq $true) {
+        $CurrentValue = @{
+            AllowedDomains = @($DomainState.SendingInfrastructure)
+            IsCompliant    = [bool]$StateIsCorrect
+        }
+        $ExpectedValue = @{
+            AllowedDomains = @($Settings.AllowedDomains.value)
+            IsCompliant    = $true
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.PhishSimSpoofIntelligence' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'PhishSimSpoofIntelligence' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1
index 6cc3a314ea55..e5d64514d13c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1
@@ -43,10 +43,9 @@ function Invoke-CIPPStandardPhishingSimulations {
     # Fetch current Phishing Simulations Policy settings and ensure it is correctly configured
     try {
         $PolicyState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-PhishSimOverridePolicy' |
-        Where-Object -Property Name -EQ 'PhishSimOverridePolicy' |
-        Select-Object -Property Identity, Name, Mode, Enabled
-    }
-    catch {
+            Where-Object -Property Name -EQ 'PhishSimOverridePolicy' |
+            Select-Object -Property Identity, Name, Mode, Enabled
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the PhishingSimulations state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -56,7 +55,7 @@ function Invoke-CIPPStandardPhishingSimulations {
 
     # Fetch current Phishing Simulations Policy Rule settings and ensure it is correctly configured
     $RuleState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-ExoPhishSimOverrideRule' |
-    Select-Object -Property Identity,Name,SenderIpRanges,Domains,SenderDomainIs
+        Select-Object -Property Identity, Name, SenderIpRanges, Domains, SenderDomainIs
 
     [String[]]$AddSenderIpRanges = $Settings.SenderIpRanges.value | Where-Object { $_ -notin $RuleState.SenderIpRanges }
     if ($Settings.RemoveExtraUrls -eq $true) {
@@ -72,13 +71,13 @@ function Invoke-CIPPStandardPhishingSimulations {
         $RemoveDomains = @()
     }
 
-    $RuleIsCorrect = ($RuleState.Name -like "*PhishSimOverr*") -and
+    $RuleIsCorrect = ($RuleState.Name -like '*PhishSimOverr*') -and
     ($AddSenderIpRanges.Count -eq 0 -and $RemoveSenderIpRanges.Count -eq 0) -and
     ($AddDomains.Count -eq 0 -and $RemoveDomains.Count -eq 0)
 
     # Fetch current Phishing Simulations URLs and ensure it is correctly configured
-    $SimUrlState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-TenantAllowBlockListItems' -cmdParams @{ListType = 'Url'; ListSubType = 'AdvancedDelivery'} |
-    Select-Object -Property Value
+    $SimUrlState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-TenantAllowBlockListItems' -cmdParams @{ListType = 'Url'; ListSubType = 'AdvancedDelivery' } |
+        Select-Object -Property Value
 
     [String[]]$AddEntries = $Settings.PhishingSimUrls.value | Where-Object { $_ -notin $SimUrlState.value }
     if ($Settings.RemoveExtraUrls -eq $true) {
@@ -98,107 +97,118 @@ function Invoke-CIPPStandardPhishingSimulations {
         PhishingSimUrls = $SimUrlState.value -join ', '
     }
 
-    If ($Settings.remediate -eq $true) {
-        If ($StateIsCorrect -eq $true) {
+    if ($Settings.remediate -eq $true) {
+        if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Advanced Phishing Simulations already correctly configured' -sev Info
-        } Else {
+        } else {
             # Remediate incorrect Phishing Simulations Policy
-            If ($PolicyIsCorrect -eq $false) {
-                If ($PolicyState.Name -eq 'PhishSimOverridePolicy') {
-                    Try {
-                        $null = New-ExoRequest -TenantId $Tenant -cmdlet 'Set-PhishSimOverridePolicy' -cmdParams @{Identity = $PolicyName; Enabled = $true}
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Enabled Phishing Simulation override policy." -sev Info
-                    } Catch {
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Failed to enable Phishing Simulation override policy." -sev Error -LogData $_
+            if ($PolicyIsCorrect -eq $false) {
+                if ($PolicyState.Name -eq 'PhishSimOverridePolicy') {
+                    try {
+                        $null = New-ExoRequest -TenantId $Tenant -cmdlet 'Set-PhishSimOverridePolicy' -cmdParams @{Identity = $PolicyName; Enabled = $true }
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Enabled Phishing Simulation override policy.' -sev Info
+                    } catch {
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Failed to enable Phishing Simulation override policy.' -sev Error -LogData $_
                     }
-                } Else {
-                    Try {
-                        $null = New-ExoRequest -TenantId $Tenant -cmdlet 'New-PhishSimOverridePolicy' -cmdParams @{Name = $PolicyName; Enabled = $true}
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Created Phishing Simulation override policy." -sev Info
-                    } Catch {
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Failed to create Phishing Simulation override policy." -sev Error -LogData $_
+                } else {
+                    try {
+                        $null = New-ExoRequest -TenantId $Tenant -cmdlet 'New-PhishSimOverridePolicy' -cmdParams @{Name = $PolicyName; Enabled = $true }
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Created Phishing Simulation override policy.' -sev Info
+                    } catch {
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Failed to create Phishing Simulation override policy.' -sev Error -LogData $_
                     }
                 }
             }
 
             # Remediate incorrect Phishing Simulations Policy Rule
-            If ($RuleIsCorrect -eq $false) {
-                If ($RuleState.Name -like "*PhishSimOverr*") {
+            if ($RuleIsCorrect -eq $false) {
+                if ($RuleState.Name -like '*PhishSimOverr*') {
                     $cmdParams = @{
-                        Identity = $RuleState.Identity
-                        AddSenderIpRanges = $AddSenderIpRanges
-                        AddDomains = $AddDomains
+                        Identity             = $RuleState.Identity
+                        AddSenderIpRanges    = $AddSenderIpRanges
+                        AddDomains           = $AddDomains
                         RemoveSenderIpRanges = $RemoveSenderIpRanges
-                        RemoveDomains = $RemoveDomains
+                        RemoveDomains        = $RemoveDomains
                     }
-                    Try {
+                    try {
                         $null = New-ExoRequest -TenantId $Tenant -cmdlet 'Set-ExoPhishSimOverrideRule' -cmdParams $cmdParams
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Updated Phishing Simulation override rule." -sev Info
-                    } Catch {
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Failed to update Phishing Simulation override rule." -sev Error -LogData $_
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Updated Phishing Simulation override rule.' -sev Info
+                    } catch {
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Failed to update Phishing Simulation override rule.' -sev Error -LogData $_
                     }
-                } Else {
+                } else {
                     $cmdParams = @{
-                        Name = $PolicyName
-                        Policy = 'PhishSimOverridePolicy'
+                        Name           = $PolicyName
+                        Policy         = 'PhishSimOverridePolicy'
                         SenderIpRanges = $Settings.SenderIpRanges.value
-                        Domains = $Settings.Domains.value
+                        Domains        = $Settings.Domains.value
                     }
-                    Try {
+                    try {
                         $null = New-ExoRequest -TenantId $Tenant -cmdlet 'New-ExoPhishSimOverrideRule' -cmdParams $cmdParams
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Created Phishing Simulation override rule." -sev Info
-                    } Catch {
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Failed to create Phishing Simulation override rule." -sev Error -LogData $_
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Created Phishing Simulation override rule.' -sev Info
+                    } catch {
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Failed to create Phishing Simulation override rule.' -sev Error -LogData $_
                     }
                 }
             }
 
             # Remediate incorrect Phishing Simulations URLs
-            If ($PhishingSimUrlsIsCorrect -eq $false) {
+            if ($PhishingSimUrlsIsCorrect -eq $false) {
                 $cmdParams = @{
-                    ListType = 'Url'
+                    ListType    = 'Url'
                     ListSubType = 'AdvancedDelivery'
                 }
                 if ($Settings.RemoveExtraUrls -eq $true) {
                     # Remove entries that are not in the settings
-                    If ($RemoveEntries.Count -gt 0) {
+                    if ($RemoveEntries.Count -gt 0) {
                         $cmdParams.Entries = $RemoveEntries
-                        Try {
+                        try {
                             $null = New-ExoRequest -TenantId $Tenant -cmdlet 'Remove-TenantAllowBlockListItems' -cmdParams $cmdParams
-                            Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Removed Phishing Simulation URLs from Allowlist." -sev Info
-                        } Catch {
-                            Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Failed to remove Phishing Simulation URLs from Allowlist." -sev Error -LogData $_
+                            Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Removed Phishing Simulation URLs from Allowlist.' -sev Info
+                        } catch {
+                            Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Failed to remove Phishing Simulation URLs from Allowlist.' -sev Error -LogData $_
                         }
                     }
                 }
                 # Add entries that are in the settings
-                If ($AddEntries.Count -gt 0) {
+                if ($AddEntries.Count -gt 0) {
                     $cmdParams.Entries = $AddEntries
                     $cmdParams.NoExpiration = $true
                     $cmdParams.Allow = $true
-                    Try {
+                    try {
                         $null = New-ExoRequest -TenantId $Tenant -cmdlet 'New-TenantAllowBlockListItems' -cmdParams $cmdParams
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Added Phishing Simulation URLs to Allowlist." -sev Info
-                    } Catch {
-                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message "Failed to add Phishing Simulation URLs to Allowlist." -sev Error -LogData $_
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Added Phishing Simulation URLs to Allowlist.' -sev Info
+                    } catch {
+                        Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Failed to add Phishing Simulation URLs to Allowlist.' -sev Error -LogData $_
                     }
                 }
             }
         }
     }
 
-    If ($Settings.alert -eq $true) {
-        If ($StateIsCorrect -eq $true) {
+    if ($Settings.alert -eq $true) {
+        if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Phishing Simulation Configuration is correctly configured' -sev Info
-        } Else {
+        } else {
             Write-StandardsAlert -message 'Phishing Simulation Configuration is not correctly configured' -object $CompareField -tenant $Tenant -standardName 'PhishingSimulations' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -Tenant $Tenant -message 'Phishing Simulation Configuration is not correctly configured' -sev Info
         }
     }
 
-    If ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : $CompareField
+    if ($Settings.report -eq $true) {
+        $CurrentValue = @{
+            Domains         = @($RuleState.Domains)
+            SenderIpRanges  = @($RuleState.SenderIpRanges)
+            PhishingSimUrls = @($SimUrlState.value)
+            IsCompliant     = $StateIsCorrect
+        }
+        $ExpectedValue = @{
+            Domains         = @($Settings.Domains.value)
+            SenderIpRanges  = @($Settings.SenderIpRanges.value)
+            PhishingSimUrls = @($Settings.PhishingSimUrls.value)
+            IsCompliant     = $true
+        }
         Add-CIPPBPAField -FieldName 'PhishingSimulations' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        Set-CIPPStandardsCompareField -FieldName 'standards.PhishingSimulations' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.PhishingSimulations' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1
index 181abe1da4ce..c802bc152a03 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1
@@ -44,7 +44,7 @@ function Invoke-CIPPStandardProfilePhotos {
     # Input validation
     if ([string]::IsNullOrWhiteSpace($StateValue)) {
         Write-LogMessage -API 'Standards' -tenant $tenant -message 'ProfilePhotos: Invalid state parameter set' -sev Error
-        Return
+        return
     }
 
     # true if wanted state is enabled, false if disabled
@@ -54,8 +54,7 @@ function Invoke-CIPPStandardProfilePhotos {
     try {
         $Uri = 'https://graph.microsoft.com/beta/admin/people/photoUpdateSettings'
         $CurrentGraphState = New-GraphGetRequest -uri $Uri -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the ProfilePhotos state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -133,6 +132,12 @@ function Invoke-CIPPStandardProfilePhotos {
                 GraphStateCorrect = $GraphStateCorrect
             }
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.ProfilePhotos' -FieldValue $FieldValue -Tenant $Tenant
+        $CurrentValue = @{
+            ProfilePhotosEnabled = $UsersCanChangePhotos
+        }
+        $ExpectedValue = @{
+            ProfilePhotosEnabled = $DesiredState
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.ProfilePhotos' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1
index 4942da7410c9..8e22526e6b29 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1
@@ -41,10 +41,9 @@ function Invoke-CIPPStandardQuarantineRequestAlert {
 
     try {
         $CurrentState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-ProtectionAlert' -Compliance |
-        Where-Object { $_.Name -eq $PolicyName } |
-        Select-Object -Property *
-    }
-    catch {
+            Where-Object { $_.Name -eq $PolicyName } |
+            Select-Object -Property *
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the QuarantineRequestAlert state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -101,11 +100,12 @@ function Invoke-CIPPStandardQuarantineRequestAlert {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'QuarantineRequestAlert' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = @{NotifyUser = $CurrentState.notifyUser }
+        $CurrentValue = @{
+            NotifyUser = @($CurrentState.NotifyUser)
+        }
+        $ExpectedValue = @{
+            NotifyUser = @($Settings.NotifyUser)
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.QuarantineRequestAlert' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.QuarantineRequestAlert' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1
index 474775e9002b..a89ce3829c0a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardQuarantineTemplate.ps1
@@ -53,117 +53,114 @@ function Invoke-CIPPStandardQuarantineTemplate {
 
     try {
         # Get the current custom quarantine policies
-        $CurrentPolicies = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-QuarantinePolicy' | Where-Object -Property Guid -ne '00000000-0000-0000-0000-000000000000' -ErrorAction Stop
+        $CurrentPolicies = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-QuarantinePolicy' | Where-Object -Property Guid -NE '00000000-0000-0000-0000-000000000000' -ErrorAction Stop
 
         # Compare the settings from standard with the current policies
         $CompareList = foreach ($Policy in $Settings) {
             try {
                 # Create hashtable with desired Quarantine Setting
-                $EndUserQuarantinePermissions   = @{
+                $EndUserQuarantinePermissions = @{
                     # ViewHeader and Download are set to false because the value 0 or 1 does nothing per Microsoft documentation
-                    PermissionToViewHeader = $false
-                    PermissionToDownload  = $false
-                    PermissionToBlockSender = $Policy.PermissionToBlockSender
-                    PermissionToDelete  = $Policy.PermissionToDelete
-                    PermissionToPreview = $Policy.PermissionToPreview
-                    PermissionToRelease = $Policy.ReleaseAction -eq "PermissionToRelease" ? $true : $false
-                    PermissionToRequestRelease  = $Policy.ReleaseAction -eq "PermissionToRequestRelease" ? $true : $false
-                    PermissionToAllowSender = $Policy.PermissionToAllowSender
+                    PermissionToViewHeader     = $false
+                    PermissionToDownload       = $false
+                    PermissionToBlockSender    = $Policy.PermissionToBlockSender
+                    PermissionToDelete         = $Policy.PermissionToDelete
+                    PermissionToPreview        = $Policy.PermissionToPreview
+                    PermissionToRelease        = $Policy.ReleaseAction -eq 'PermissionToRelease' ? $true : $false
+                    PermissionToRequestRelease = $Policy.ReleaseAction -eq 'PermissionToRequestRelease' ? $true : $false
+                    PermissionToAllowSender    = $Policy.PermissionToAllowSender
                 }
 
                 # If the Quarantine Policy already exists
                 if ($Policy.displayName.value -in $CurrentPolicies.Name) {
                     #Get the current policy and convert EndUserQuarantinePermissions from string to hashtable for compare
-                    $ExistingPolicy = $CurrentPolicies | Where-Object -Property Name -eq $Policy.displayName.value
+                    $ExistingPolicy = $CurrentPolicies | Where-Object -Property Name -EQ $Policy.displayName.value
                     $ExistingPolicyEndUserQuarantinePermissions = Convert-QuarantinePermissionsValue -InputObject $ExistingPolicy.EndUserQuarantinePermissions -ErrorAction Stop
 
                     #Compare the current policy
                     $StateIsCorrect = ($ExistingPolicy.Name -eq $Policy.displayName.value) -and
-                                ($ExistingPolicy.ESNEnabled -eq $Policy.ESNEnabled) -and
-                                ($ExistingPolicy.IncludeMessagesFromBlockedSenderAddress -eq $Policy.IncludeMessagesFromBlockedSenderAddress) -and
-                                (!(Compare-Object @($ExistingPolicyEndUserQuarantinePermissions.values) @($EndUserQuarantinePermissions.values)))
+                    ($ExistingPolicy.ESNEnabled -eq $Policy.ESNEnabled) -and
+                    ($ExistingPolicy.IncludeMessagesFromBlockedSenderAddress -eq $Policy.IncludeMessagesFromBlockedSenderAddress) -and
+                    (!(Compare-Object @($ExistingPolicyEndUserQuarantinePermissions.values) @($EndUserQuarantinePermissions.values)))
 
                     # If the current policy is correct
                     if ($StateIsCorrect -eq $true) {
                         [PSCustomObject]@{
-                            missing         = $false
-                            StateIsCorrect  = $StateIsCorrect
-                            Action          = "None"
-                            displayName     = $Policy.displayName.value
-                            EndUserQuarantinePermissions = $EndUserQuarantinePermissions
-                            ESNEnabled      = $Policy.ESNEnabled
+                            missing                                 = $false
+                            StateIsCorrect                          = $StateIsCorrect
+                            Action                                  = 'None'
+                            displayName                             = $Policy.displayName.value
+                            EndUserQuarantinePermissions            = $EndUserQuarantinePermissions
+                            ESNEnabled                              = $Policy.ESNEnabled
                             IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
-                            remediate       = $Policy.remediate
-                            alert           = $Policy.alert
-                            report          = $Policy.report
+                            remediate                               = $Policy.remediate
+                            alert                                   = $Policy.alert
+                            report                                  = $Policy.report
                         }
                     }
                     #If the current policy doesn't match the desired settings
                     else {
                         [PSCustomObject]@{
-                            missing         = $false
-                            StateIsCorrect  = $StateIsCorrect
-                            Action          = "Update"
-                            displayName     = $Policy.displayName.value
-                            EndUserQuarantinePermissions = $EndUserQuarantinePermissions
-                            ESNEnabled      = $Policy.ESNEnabled
+                            missing                                 = $false
+                            StateIsCorrect                          = $StateIsCorrect
+                            Action                                  = 'Update'
+                            displayName                             = $Policy.displayName.value
+                            EndUserQuarantinePermissions            = $EndUserQuarantinePermissions
+                            ESNEnabled                              = $Policy.ESNEnabled
                             IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
-                            remediate       = $Policy.remediate
-                            alert           = $Policy.alert
-                            report          = $Policy.report
+                            remediate                               = $Policy.remediate
+                            alert                                   = $Policy.alert
+                            report                                  = $Policy.report
                         }
                     }
                 }
                 #If no existing Quarantine Policy with the same name was found
                 else {
                     [PSCustomObject]@{
-                        missing         = $true
-                        StateIsCorrect  = $false
-                        Action          = "Create"
-                        displayName     = $Policy.displayName.value
-                        EndUserQuarantinePermissions = $EndUserQuarantinePermissions
-                        ESNEnabled      = $Policy.ESNEnabled
+                        missing                                 = $true
+                        StateIsCorrect                          = $false
+                        Action                                  = 'Create'
+                        displayName                             = $Policy.displayName.value
+                        EndUserQuarantinePermissions            = $EndUserQuarantinePermissions
+                        ESNEnabled                              = $Policy.ESNEnabled
                         IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
-                        remediate       = $Policy.remediate
-                        alert           = $Policy.alert
-                        report          = $Policy.report
+                        remediate                               = $Policy.remediate
+                        alert                                   = $Policy.alert
+                        report                                  = $Policy.report
                     }
                 }
-            }
-            catch {
+            } catch {
                 $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                 $Message = "Failed to compare Quarantine policy $($Policy.displayName.value), Error: $ErrorMessage"
                 Write-LogMessage -API $APIName -tenant $tenant -message $Message -sev 'Error'
-                Return $Message
+                return $Message
             }
         }
 
 
-        If ($true -in $Settings.remediate) {
+        if ($true -in $Settings.remediate) {
             # Remediate each policy which is incorrect or missing
-            foreach ($Policy in $CompareList | Where-Object { $_.remediate -EQ $true -and $_.StateIsCorrect -eq $false }) {
+            foreach ($Policy in $CompareList | Where-Object { $_.remediate -eq $true -and $_.StateIsCorrect -eq $false }) {
                 try {
                     # Parameters for splatting to Set-CIPPQuarantinePolicy
                     $Params = @{
-                        Action = $Policy.Action
-                        Identity = $Policy.displayName
-                        EndUserQuarantinePermissions = $Policy.EndUserQuarantinePermissions
-                        ESNEnabled = $Policy.ESNEnabled
+                        Action                                  = $Policy.Action
+                        Identity                                = $Policy.displayName
+                        EndUserQuarantinePermissions            = $Policy.EndUserQuarantinePermissions
+                        ESNEnabled                              = $Policy.ESNEnabled
                         IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
-                        tenantFilter = $Tenant
-                        APIName = $APIName
+                        tenantFilter                            = $Tenant
+                        APIName                                 = $APIName
                     }
 
                     try {
                         Set-CIPPQuarantinePolicy @Params
                         Write-LogMessage -API $APIName -tenant $Tenant -message "$($Policy.Action)d Custom Quarantine Policy '$($Policy.displayName)'" -sev Info
-                    }
-                    catch {
+                    } catch {
                         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                         Write-LogMessage -API $APIName -tenant $tenant -message "Failed to $($Policy.Action) Quarantine policy $($Policy.displayName), Error: $ErrorMessage" -sev 'Error'
                     }
-                }
-                catch {
+                } catch {
                     $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
                     Write-LogMessage -API $APIName -tenant $tenant -message "Failed to create or update Quarantine policy $($Policy.displayName), Error: $ErrorMessage" -sev 'Error'
                 }
@@ -174,15 +171,13 @@ function Invoke-CIPPStandardQuarantineTemplate {
             foreach ($Policy in $CompareList | Where-Object -Property alert -EQ $true) {
                 if ($Policy.StateIsCorrect) {
                     Write-LogMessage -API $APIName -tenant $Tenant -message "Quarantine policy $($Policy.displayName) has the correct configuration." -sev Info
-                }
-                else {
+                } else {
                     if ($Policy.missing) {
                         $CurrentInfo = $Policy | Select-Object -Property displayName, missing
                         Write-StandardsAlert -message "Quarantine policy $($Policy.displayName) is missing." -object $CurrentInfo -tenant $Tenant -standardName 'QuarantineTemplate' -standardId $Settings.templateId
                         Write-LogMessage -API $APIName -tenant $Tenant -message "Quarantine policy $($Policy.displayName) is missing." -sev info
-                    }
-                    else {
-                        $CurrentInfo = $CurrentPolicies | Where-Object -Property Name -eq $Policy.displayName | Select-Object -Property Name, ESNEnabled, IncludeMessagesFromBlockedSenderAddress, EndUserQuarantinePermissions
+                    } else {
+                        $CurrentInfo = $CurrentPolicies | Where-Object -Property Name -EQ $Policy.displayName | Select-Object -Property Name, ESNEnabled, IncludeMessagesFromBlockedSenderAddress, EndUserQuarantinePermissions
                         Write-StandardsAlert -message "Quarantine policy $($Policy.displayName) does not match the expected configuration." -object $CurrentInfo -tenant $Tenant -standardName 'QuarantineTemplate' -standardId $Settings.templateId
                         Write-LogMessage -API $APIName -tenant $Tenant -message "Quarantine policy $($Policy.displayName) does not match the expected configuration. We've generated an alert" -sev info
                     }
@@ -194,11 +189,29 @@ function Invoke-CIPPStandardQuarantineTemplate {
             foreach ($Policy in $CompareList | Where-Object -Property report -EQ $true) {
                 # Convert displayName to hex to avoid invalid characters "/, \, #, ?" which are not allowed in RowKey, but "\, #, ?" can be used in quarantine displayName
                 $HexName = -join ($Policy.displayName.ToCharArray() | ForEach-Object { '{0:X2}' -f [int][char]$_ })
-                Set-CIPPStandardsCompareField -FieldName "standards.QuarantineTemplate.$HexName" -FieldValue $Policy.StateIsCorrect -TenantFilter $Tenant
+
+                $CurrentValue = @{
+                    displayName                             = $Policy.displayName
+                    EndUserQuarantinePermissions            = $Policy.EndUserQuarantinePermissions
+                    ESNEnabled                              = $Policy.ESNEnabled
+                    IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
+                    StateIsCorrect                          = $Policy.StateIsCorrect
+                    missing                                 = $Policy.missing
+                }
+
+                $ExpectedValue = @{
+                    displayName                             = $Policy.displayName
+                    EndUserQuarantinePermissions            = $Policy.EndUserQuarantinePermissions
+                    ESNEnabled                              = $Policy.ESNEnabled
+                    IncludeMessagesFromBlockedSenderAddress = $Policy.IncludeMessagesFromBlockedSenderAddress
+                    StateIsCorrect                          = $true
+                    missing                                 = $false
+                }
+
+                Set-CIPPStandardsCompareField -FieldName "standards.QuarantineTemplate.$HexName" -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
             }
         }
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API $APIName -tenant $tenant -message "Failed to create or update Quarantine policy/policies, Error: $ErrorMessage" -sev 'Error'
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1
index b84aca5fe2c9..d140c767a1da 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1
@@ -32,8 +32,7 @@ function Invoke-CIPPStandardRestrictThirdPartyStorageServices {
     #>
 
     param ($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'RestrictThirdPartyStorageServices'
-    $TestResult = Test-CIPPStandardLicense -StandardName 'ThirdPartyStorageServicesRestricted' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'ThirdPartyStorageServicesRestricted' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -89,13 +88,15 @@ function Invoke-CIPPStandardRestrictThirdPartyStorageServices {
     }
 
     if ($Settings.report -eq $true) {
-        if ($null -eq $CurrentState.accountEnabled -or $CurrentState.accountEnabled -eq $true) {
-            Set-CIPPStandardsCompareField -FieldName 'standards.RestrictThirdPartyStorageServices' -FieldValue $false -Tenant $Tenant
-            Add-CIPPBPAField -FieldName 'ThirdPartyStorageServicesRestricted' -FieldValue $false -StoreAs bool -Tenant $Tenant
-        } else {
-            $CorrectState = $CurrentState.accountEnabled -eq $false ? $true : $false
-            Set-CIPPStandardsCompareField -FieldName 'standards.RestrictThirdPartyStorageServices' -FieldValue $CorrectState -Tenant $Tenant
-            Add-CIPPBPAField -FieldName 'ThirdPartyStorageServicesRestricted' -FieldValue $CorrectState -StoreAs bool -Tenant $Tenant
+
+        $CurrentValue = @{
+            thirdPartyStorageRestricted = $CurrentState.accountEnabled -eq $false
         }
+        $ExpectedValue = @{
+            thirdPartyStorageRestricted = $false
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.RestrictThirdPartyStorageServices' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+        Add-CIPPBPAField -FieldName 'ThirdPartyStorageServicesRestricted' -FieldValue ($CurrentState.accountEnabled -eq $false) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1
index 438d70c82afa..cb992130b094 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1
@@ -43,12 +43,11 @@ function Invoke-CIPPStandardRetentionPolicyTag {
 
     try {
         $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-RetentionPolicyTag' |
-        Where-Object -Property Identity -EQ $PolicyName
+            Where-Object -Property Identity -EQ $PolicyName
 
         $PolicyState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-RetentionPolicy' |
-        Where-Object -Property Identity -EQ 'Default MRM Policy'
-    }
-    catch {
+            Where-Object -Property Identity -EQ 'Default MRM Policy'
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the RetentionPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -126,12 +125,22 @@ function Invoke-CIPPStandardRetentionPolicyTag {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'RetentionPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = @{ CurrentState = $CurrentState; PolicyState = $PolicyState }
+        $CurrentValue = @{
+            retentionEnabled     = $CurrentState.RetentionEnabled
+            retentionAction      = $CurrentState.RetentionAction
+            ageLimitForRetention = $CurrentState.AgeLimitForRetention.TotalDays
+            type                 = $CurrentState.Type
+            policyTagLinked      = $PolicyState.RetentionPolicyTagLinks -contains $PolicyName
+
+        }
+        $ExpectedValue = @{
+            retentionEnabled     = $true
+            retentionAction      = 'PermanentlyDelete'
+            ageLimitForRetention = $Settings.AgeLimitForRetention
+            type                 = 'DeletedItems'
+            policyTagLinked      = $true
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.RetentionPolicyTag' -FieldValue $FieldValue -Tenant $Tenant
-    }
 
+        Set-CIPPStandardsCompareField -FieldName 'standards.RetentionPolicyTag' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
+    }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1
index 846f3b93eadb..931795adb66b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1
@@ -42,8 +42,7 @@ function Invoke-CIPPStandardRotateDKIM {
 
     try {
         $DKIM = (New-ExoRequest -tenantid $tenant -cmdlet 'Get-DkimSigningConfig') | Where-Object { $_.Selector1KeySize -eq 1024 -and $_.Enabled -eq $true }
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DKIM state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -78,10 +77,13 @@ function Invoke-CIPPStandardRotateDKIM {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'DKIM' -FieldValue $DKIM -StoreAs json -Tenant $tenant
-        if ($DKIM) {
-            Set-CIPPStandardsCompareField -FieldName 'standards.RotateDKIM' -FieldValue $DKIM -Tenant $tenant
-        } else {
-            Set-CIPPStandardsCompareField -FieldName 'standards.RotateDKIM' -FieldValue $true -Tenant $tenant
+
+        $CurrentValue = @{
+            domainsWith1024BitDKIM = if ($DKIM) { $DKIM.Identity } else { @() }
+        }
+        $ExpectedValue = @{
+            domainsWith1024BitDKIM = @()
         }
+        Set-CIPPStandardsCompareField -FieldName 'standards.RotateDKIM' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1
index 767910a0793f..6a4d323ed5a1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1
@@ -32,7 +32,7 @@ function Invoke-CIPPStandardSPAzureB2B {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'SPAzureB2B' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'SPAzureB2B' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -41,9 +41,8 @@ function Invoke-CIPPStandardSPAzureB2B {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object -Property _ObjectIdentity_, TenantFilter, EnableAzureADB2BIntegration
-    }
-    catch {
+            Select-Object -Property _ObjectIdentity_, TenantFilter, EnableAzureADB2BIntegration
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPAzureB2B state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -81,11 +80,13 @@ function Invoke-CIPPStandardSPAzureB2B {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'AzureB2B' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+
+        $CurrentValue = @{
+            EnableAzureADB2BIntegration = $CurrentState.EnableAzureADB2BIntegration
+        }
+        $ExpectedValue = @{
+            EnableAzureADB2BIntegration = $true
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPAzureB2B' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPAzureB2B' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1
index a7e9e3a8a2ff..a2ac80b497d4 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1
@@ -7,8 +7,8 @@ function Invoke-CIPPStandardSPDirectSharing {
     .SYNOPSIS
         (Label) Default sharing to Direct users
     .DESCRIPTION
-        (Helptext) This standard has been deprecated in favor of the Default Sharing Link standard. 
-        (DocsDescription) This standard has been deprecated in favor of the Default Sharing Link standard. 
+        (Helptext) This standard has been deprecated in favor of the Default Sharing Link standard.
+        (DocsDescription) This standard has been deprecated in favor of the Default Sharing Link standard.
     .NOTES
         CAT
             SharePoint Standards
@@ -32,7 +32,7 @@ function Invoke-CIPPStandardSPDirectSharing {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'SPDirectSharing' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'SPDirectSharing' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -43,9 +43,8 @@ function Invoke-CIPPStandardSPDirectSharing {
     Write-LogMessage -API 'Standards' -Tenant $Tenant -Message 'The default sharing to Direct users standard has been deprecated in favor of the "Set Default Sharing Link Settings" standard. Please update your standards to use new standard. However this will continue to function.' -Sev Alert
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object -Property _ObjectIdentity_, TenantFilter, DefaultSharingLinkType
-    }
-    catch {
+            Select-Object -Property _ObjectIdentity_, TenantFilter, DefaultSharingLinkType
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPDirectSharing state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -84,11 +83,12 @@ function Invoke-CIPPStandardSPDirectSharing {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'DirectSharing' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            DefaultSharingLinkType = $CurrentState.DefaultSharingLinkType
+        }
+        $ExpectedValue = @{
+            DefaultSharingLinkType = 1
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPDirectSharing' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPDirectSharing' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1
index dbbf748b9739..5612ce7c034e 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1
@@ -29,7 +29,7 @@ function Invoke-CIPPStandardSPDisableLegacyWorkflows {
         https://docs.cipp.app/user-documentation/tenant/standards/list-standards
     #>
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'SPDisableLegacyWorkflows' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'SPDisableLegacyWorkflows' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -38,9 +38,8 @@ function Invoke-CIPPStandardSPDisableLegacyWorkflows {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object -Property *
-    }
-    catch {
+            Select-Object -Property *
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPDisableLegacyWorkflows state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -82,11 +81,17 @@ function Invoke-CIPPStandardSPDisableLegacyWorkflows {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SPDisableLegacyWorkflows' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+
+        $CurrentValue = @{
+            StopNew2010Workflows = $CurrentState.StopNew2010Workflows
+            StopNew2013Workflows = $CurrentState.StopNew2013Workflows
+            DisableBackToClassic = $CurrentState.DisableBackToClassic
+        }
+        $ExpectedValue = @{
+            StopNew2010Workflows = $true
+            StopNew2013Workflows = $true
+            DisableBackToClassic = $true
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPDisableLegacyWorkflows' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPDisableLegacyWorkflows' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1
index 03bd09556c31..650647f6a0e0 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1
@@ -85,11 +85,12 @@ function Invoke-CIPPStandardSPDisallowInfectedFiles {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SPDisallowInfectedFiles' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            DisallowInfectedFileDownload = $CurrentState.DisallowInfectedFileDownload
+        }
+        $ExpectedValue = @{
+            DisallowInfectedFileDownload = $true
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPDisallowInfectedFiles' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPDisallowInfectedFiles' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1
index c454a1976170..965b5bf90d5c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1
@@ -35,7 +35,7 @@ function Invoke-CIPPStandardSPEmailAttestation {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'SPEmailAttestation' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'SPEmailAttestation' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -44,9 +44,8 @@ function Invoke-CIPPStandardSPEmailAttestation {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object -Property _ObjectIdentity_, TenantFilter, EmailAttestationReAuthDays, EmailAttestationRequired
-    }
-    catch {
+            Select-Object -Property _ObjectIdentity_, TenantFilter, EmailAttestationReAuthDays, EmailAttestationRequired
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPEmailAttestation state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -91,11 +90,15 @@ function Invoke-CIPPStandardSPEmailAttestation {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SPEmailAttestation' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+
+        $CurrentValue = @{
+            EmailAttestationReAuthDays = $CurrentState.EmailAttestationReAuthDays
+            EmailAttestationRequired   = $CurrentState.EmailAttestationRequired
+        }
+        $ExpectedValue = @{
+            EmailAttestationReAuthDays = [int]$Settings.Days
+            EmailAttestationRequired   = $true
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPEmailAttestation' -FieldValue $FieldValue -TenantFilter $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPEmailAttestation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1
index 96be5ff61600..f5595d9263f1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1
@@ -34,7 +34,7 @@ function Invoke-CIPPStandardSPExternalUserExpiration {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'SPExternalUserExpiration' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'SPExternalUserExpiration' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -43,9 +43,8 @@ function Invoke-CIPPStandardSPExternalUserExpiration {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object -Property _ObjectIdentity_, TenantFilter, ExternalUserExpireInDays, ExternalUserExpirationRequired
-    }
-    catch {
+            Select-Object -Property _ObjectIdentity_, TenantFilter, ExternalUserExpireInDays, ExternalUserExpirationRequired
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPExternalUserExpiration state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -90,7 +89,15 @@ function Invoke-CIPPStandardSPExternalUserExpiration {
         } else {
             $FieldValue = $CurrentState
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPExternalUserExpiration' -FieldValue $FieldValue -TenantFilter $Tenant
+        $CurrentValue = @{
+            ExternalUserExpireInDays       = $CurrentState.ExternalUserExpireInDays
+            ExternalUserExpirationRequired = $CurrentState.ExternalUserExpirationRequired
+        }
+        $ExpectedValue = @{
+            ExternalUserExpireInDays       = $Settings.Days
+            ExternalUserExpirationRequired = $true
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPExternalUserExpiration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'standards.SPExternalUserExpiration' -FieldValue $FieldValue -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1
index 7d01dbbcdca4..1354beba7a7d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1
@@ -33,7 +33,7 @@ function Invoke-CIPPStandardSPFileRequests {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'SPFileRequests' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'SPFileRequests' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-LogMessage -API 'Standards' -tenant $tenant -message 'The tenant is not licenced for this standard SPFileRequests' -sev Error
@@ -42,14 +42,13 @@ function Invoke-CIPPStandardSPFileRequests {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant | Select-Object _ObjectIdentity_, TenantFilter, CoreRequestFilesLinkEnabled, OneDriveRequestFilesLinkEnabled, CoreRequestFilesLinkExpirationInDays, OneDriveRequestFilesLinkExpirationInDays
-    }
-    catch {
+    } catch {
         Write-LogMessage -API 'Standards' -tenant $tenant -message 'Failed to get current state of SPO tenant details' -sev Error
         return
     }
 
     # Input validation
-    if (($Settings.state -eq $null) -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
+    if (($null -eq $Settings.state) -and ($Settings.remediate -eq $true -or $Settings.alert -eq $true)) {
         Write-LogMessage -API 'Standards' -tenant $tenant -message 'Invalid state parameter set for standard SPFileRequests' -sev Error
         return
     }
@@ -65,7 +64,7 @@ function Invoke-CIPPStandardSPFileRequests {
 
     # Check expiration settings if specified
     $ExpirationIsCorrect = $true
-    if ($ExpirationDays -ne $null -and $WantedState -eq $true) {
+    if ($null -ne $ExpirationDays -and $WantedState -eq $true) {
         $CoreExpirationIsCorrect = ($CurrentState.CoreRequestFilesLinkExpirationInDays -eq $ExpirationDays)
         $OneDriveExpirationIsCorrect = ($CurrentState.OneDriveRequestFilesLinkExpirationInDays -eq $ExpirationDays)
         $ExpirationIsCorrect = $CoreExpirationIsCorrect -and $OneDriveExpirationIsCorrect
@@ -78,37 +77,37 @@ function Invoke-CIPPStandardSPFileRequests {
         if ($AllSettingsCorrect -eq $false) {
             try {
                 $Properties = @{
-                    CoreRequestFilesLinkEnabled = $WantedState
+                    CoreRequestFilesLinkEnabled     = $WantedState
                     OneDriveRequestFilesLinkEnabled = $WantedState
                 }
 
                 # Add expiration settings if specified and feature is being enabled
-                if ($ExpirationDays -ne $null -and $WantedState -eq $true) {
+                if ($null -ne $ExpirationDays -and $WantedState -eq $true) {
                     $Properties['CoreRequestFilesLinkExpirationInDays'] = $ExpirationDays
                     $Properties['OneDriveRequestFilesLinkExpirationInDays'] = $ExpirationDays
                 }
 
                 $CurrentState | Set-CIPPSPOTenant -Properties $Properties
 
-                $ExpirationMessage = if ($ExpirationDays -ne $null -and $WantedState -eq $true) { " with $ExpirationDays day expiration" } else { "" }
+                $ExpirationMessage = if ($null -ne $ExpirationDays -and $WantedState -eq $true) { " with $ExpirationDays day expiration" } else { '' }
                 Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set File Requests to $HumanReadableState$ExpirationMessage" -sev Info
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
                 Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set File Requests to $HumanReadableState. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
             }
         } else {
-            $ExpirationMessage = if ($ExpirationDays -ne $null -and $WantedState -eq $true) { " with $ExpirationDays day expiration" } else { "" }
+            $ExpirationMessage = if ($null -ne $ExpirationDays -and $WantedState -eq $true) { " with $ExpirationDays day expiration" } else { '' }
             Write-LogMessage -API 'Standards' -tenant $tenant -message "File Requests are already set to the wanted state of $HumanReadableState$ExpirationMessage" -sev Info
         }
     }
 
     if ($Settings.alert -eq $true) {
         if ($AllSettingsCorrect -eq $true) {
-            $ExpirationMessage = if ($ExpirationDays -ne $null -and $WantedState -eq $true) { " with $ExpirationDays day expiration" } else { "" }
+            $ExpirationMessage = if ($null -ne $ExpirationDays -and $WantedState -eq $true) { " with $ExpirationDays day expiration" } else { '' }
             Write-LogMessage -API 'Standards' -tenant $tenant -message "File Requests are already set to the wanted state of $HumanReadableState$ExpirationMessage" -sev Info
         } else {
             $AlertMessage = "File Requests are not set to the wanted state of $HumanReadableState"
-            if ($ExpirationDays -ne $null -and $WantedState -eq $true) {
+            if ($null -ne $ExpirationDays -and $WantedState -eq $true) {
                 $AlertMessage += " with $ExpirationDays day expiration"
             }
             Write-StandardsAlert -message $AlertMessage -object $CurrentState -tenant $tenant -standardName 'SPFileRequests' -standardId $Settings.standardId
@@ -121,16 +120,23 @@ function Invoke-CIPPStandardSPFileRequests {
         Add-CIPPBPAField -FieldName 'SPCoreFileRequestsEnabled' -FieldValue $CurrentState.CoreRequestFilesLinkEnabled -StoreAs bool -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'SPOneDriveFileRequestsEnabled' -FieldValue $CurrentState.OneDriveRequestFilesLinkEnabled -StoreAs bool -Tenant $Tenant
 
-        if ($ExpirationDays -ne $null) {
+        if ($null -ne $ExpirationDays) {
             Add-CIPPBPAField -FieldName 'SPCoreFileRequestsExpirationDays' -FieldValue $CurrentState.CoreRequestFilesLinkExpirationInDays -StoreAs string -Tenant $Tenant
             Add-CIPPBPAField -FieldName 'SPOneDriveFileRequestsExpirationDays' -FieldValue $CurrentState.OneDriveRequestFilesLinkExpirationInDays -StoreAs string -Tenant $Tenant
         }
 
-        if ($AllSettingsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            CoreRequestFilesLinkEnabled              = $CurrentState.CoreRequestFilesLinkEnabled
+            OneDriveRequestFilesLinkEnabled          = $CurrentState.OneDriveRequestFilesLinkEnabled
+            CoreRequestFilesLinkExpirationInDays     = $CurrentState.CoreRequestFilesLinkExpirationInDays
+            OneDriveRequestFilesLinkExpirationInDays = $CurrentState.OneDriveRequestFilesLinkExpirationInDays
+        }
+        $ExpectedValue = @{
+            CoreRequestFilesLinkEnabled              = $WantedState
+            OneDriveRequestFilesLinkEnabled          = $WantedState
+            CoreRequestFilesLinkExpirationInDays     = if ($null -ne $ExpirationDays -and $WantedState -eq $true) { $ExpirationDays } else { $null }
+            OneDriveRequestFilesLinkExpirationInDays = if ($null -ne $ExpirationDays -and $WantedState -eq $true) { $ExpirationDays } else { $null }
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPFileRequests' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPFileRequests' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1
index fec4d5f3a99f..0c39478cd85b 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1
@@ -31,7 +31,7 @@ function Invoke-CIPPStandardSPSyncButtonState {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'SPSyncButtonState' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'SPSyncButtonState' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -40,8 +40,7 @@ function Invoke-CIPPStandardSPSyncButtonState {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant | Select-Object _ObjectIdentity_, TenantFilter, HideSyncButtonOnDocLib
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SPSyncButtonState state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -92,7 +91,13 @@ function Invoke-CIPPStandardSPSyncButtonState {
         } else {
             $FieldValue = $CurrentState
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SPSyncButtonState' -FieldValue $FieldValue -Tenant $Tenant
+        $CurrentValue = @{
+            HideSyncButtonOnDocLib = $CurrentState.HideSyncButtonOnDocLib
+        }
+        $ExpectedValue = @{
+            HideSyncButtonOnDocLib = $WantedState
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.SPSyncButtonState' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
index 6acbaaeca1c6..1627aaceaa5d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
@@ -76,10 +76,9 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
 
         try {
             $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentPolicy' |
-            Where-Object -Property Name -EQ $PolicyName |
-            Select-Object Name, Enable, Action, QuarantineTag, Redirect, RedirectAddress
-        }
-        catch {
+                Where-Object -Property Name -EQ $PolicyName |
+                Select-Object Name, Enable, Action, QuarantineTag, Redirect, RedirectAddress
+        } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SafeAttachmentPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error
             return
@@ -95,8 +94,8 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
         $AcceptedDomains = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-AcceptedDomain'
 
         $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeAttachmentRule' |
-        Where-Object -Property Name -EQ $RuleName |
-        Select-Object Name, SafeAttachmentPolicy, Priority, RecipientDomainIs
+            Where-Object -Property Name -EQ $RuleName |
+            Select-Object Name, SafeAttachmentPolicy, Priority, RecipientDomainIs
 
         $RuleStateIsCorrect = ($RuleState.Name -eq $RuleName) -and
         ($RuleState.SafeAttachmentPolicy -eq $PolicyName) -and
@@ -177,12 +176,25 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
 
         if ($Settings.report -eq $true) {
             Add-CIPPBPAField -FieldName 'SafeAttachmentPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
-            if ($StateIsCorrect) {
-                $FieldValue = $true
-            } else {
-                $FieldValue = $CurrentState
+
+            $CurrentValue = @{
+                name            = $CurrentState.Name
+                enable          = $CurrentState.Enable
+                action          = $CurrentState.Action
+                quarantineTag   = $CurrentState.QuarantineTag
+                redirect        = $CurrentState.Redirect
+                redirectAddress = $CurrentState.RedirectAddress
+            }
+
+            $ExpectedValue = @{
+                name            = $PolicyName
+                enable          = $true
+                action          = $Settings.SafeAttachmentAction
+                quarantineTag   = $Settings.QuarantineTag
+                redirect        = $Settings.Redirect
+                redirectAddress = $Settings.RedirectAddress
             }
-            Set-CIPPStandardsCompareField -FieldName 'standards.SafeAttachmentPolicy' -FieldValue $FieldValue -Tenant $Tenant
+            Set-CIPPStandardsCompareField -FieldName 'standards.SafeAttachmentPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         }
     } else {
         if ($Settings.remediate -eq $true) {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
index 1927d31de13d..bd7fadbfbbb4 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
@@ -75,10 +75,9 @@ function Invoke-CIPPStandardSafeLinksPolicy {
 
         try {
             $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeLinksPolicy' |
-            Where-Object -Property Name -EQ $PolicyName |
-            Select-Object Name, EnableSafeLinksForEmail, EnableSafeLinksForTeams, EnableSafeLinksForOffice, TrackClicks, AllowClickThrough, ScanUrls, EnableForInternalSenders, DeliverMessageAfterScan, DisableUrlRewrite, EnableOrganizationBranding, DoNotRewriteUrls
-        }
-        catch {
+                Where-Object -Property Name -EQ $PolicyName |
+                Select-Object Name, EnableSafeLinksForEmail, EnableSafeLinksForTeams, EnableSafeLinksForOffice, TrackClicks, AllowClickThrough, ScanUrls, EnableForInternalSenders, DeliverMessageAfterScan, DisableUrlRewrite, EnableOrganizationBranding, DoNotRewriteUrls
+        } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
             Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SafeLinksPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error
             return
@@ -188,12 +187,36 @@ function Invoke-CIPPStandardSafeLinksPolicy {
 
         if ($Settings.report -eq $true) {
             Add-CIPPBPAField -FieldName 'SafeLinksPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
-            if ($StateIsCorrect) {
-                $FieldValue = $true
-            } else {
-                $FieldValue = $CurrentState
+
+            $CurrentValue = @{
+                Name                       = $CurrentState.Name
+                EnableSafeLinksForEmail    = $CurrentState.EnableSafeLinksForEmail
+                EnableSafeLinksForTeams    = $CurrentState.EnableSafeLinksForTeams
+                EnableSafeLinksForOffice   = $CurrentState.EnableSafeLinksForOffice
+                TrackClicks                = $CurrentState.TrackClicks
+                AllowClickThrough          = $CurrentState.AllowClickThrough
+                ScanUrls                   = $CurrentState.ScanUrls
+                EnableForInternalSenders   = $CurrentState.EnableForInternalSenders
+                DeliverMessageAfterScan    = $CurrentState.DeliverMessageAfterScan
+                DisableUrlRewrite          = $CurrentState.DisableUrlRewrite
+                EnableOrganizationBranding = $CurrentState.EnableOrganizationBranding
+                DoNotRewriteUrls           = $CurrentState.DoNotRewriteUrls
+            }
+            $ExpectedValue = @{
+                Name                       = $PolicyName
+                EnableSafeLinksForEmail    = $true
+                EnableSafeLinksForTeams    = $true
+                EnableSafeLinksForOffice   = $true
+                TrackClicks                = $true
+                AllowClickThrough          = $Settings.AllowClickThrough
+                ScanUrls                   = $true
+                EnableForInternalSenders   = $true
+                DeliverMessageAfterScan    = $true
+                DisableUrlRewrite          = $Settings.DisableUrlRewrite
+                EnableOrganizationBranding = $Settings.EnableOrganizationBranding
+                DoNotRewriteUrls           = $Settings.DoNotRewriteUrls.value ?? @()
             }
-            Set-CIPPStandardsCompareField -FieldName 'standards.SafeLinksPolicy' -FieldValue $FieldValue -Tenant $Tenant
+            Set-CIPPStandardsCompareField -FieldName 'standards.SafeLinksPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         }
     } else {
         if ($Settings.remediate -eq $true) {
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1
index a7d12eafa791..f3a91c2a43e6 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1
@@ -48,7 +48,7 @@ function Invoke-CIPPStandardSafeLinksTemplatePolicy {
     # Normalize template list property
     $TemplateList = Get-NormalizedTemplateList -Settings $Settings
     if (-not $TemplateList) {
-        Write-LogMessage -API 'Standards' -tenant $Tenant -message "No templates selected for SafeLinks policy deployment" -sev Error
+        Write-LogMessage -API 'Standards' -tenant $Tenant -message 'No templates selected for SafeLinks policy deployment' -sev Error
         return
     }
 
@@ -101,8 +101,7 @@ function Get-NormalizedTemplateList {
 
     if ($Settings.'standards.SafeLinksTemplatePolicy.TemplateIds') {
         return $Settings.'standards.SafeLinksTemplatePolicy.TemplateIds'
-    }
-    elseif ($Settings.TemplateIds) {
+    } elseif ($Settings.TemplateIds) {
         return $Settings.TemplateIds
     }
 
@@ -134,17 +133,13 @@ function ConvertTo-SafeArray {
         foreach ($item in $Field) {
             if ($item -is [string]) {
                 $ResultList.Add($item)
-            }
-            elseif ($item.value) {
+            } elseif ($item.value) {
                 $ResultList.Add($item.value)
-            }
-            elseif ($item.userPrincipalName) {
+            } elseif ($item.userPrincipalName) {
                 $ResultList.Add($item.userPrincipalName)
-            }
-            elseif ($item.id) {
+            } elseif ($item.id) {
                 $ResultList.Add($item.id)
-            }
-            else {
+            } else {
                 $ResultList.Add($item.ToString())
             }
         }
@@ -184,22 +179,20 @@ function Get-ExistingSafeLinksObjects {
     try {
         $ExistingPolicies = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeLinksPolicy' -useSystemMailbox $true
         $PolicyExists = $ExistingPolicies | Where-Object { $_.Name -eq $PolicyName }
-    }
-    catch {
+    } catch {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to retrieve existing policies: $($_.Exception.Message)" -sev Warning
     }
 
     try {
         $ExistingRules = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-SafeLinksRule' -useSystemMailbox $true
         $RuleExists = $ExistingRules | Where-Object { $_.Name -eq $RuleName }
-    }
-    catch {
+    } catch {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to retrieve existing rules: $($_.Exception.Message)" -sev Warning
     }
 
     return @{
         PolicyExists = $PolicyExists
-        RuleExists = $RuleExists
+        RuleExists   = $RuleExists
     }
 }
 
@@ -207,17 +200,17 @@ function New-SafeLinksPolicyParameters {
     param($Template)
 
     $PolicyMappings = @{
-        'EnableSafeLinksForEmail' = 'EnableSafeLinksForEmail'
-        'EnableSafeLinksForTeams' = 'EnableSafeLinksForTeams'
-        'EnableSafeLinksForOffice' = 'EnableSafeLinksForOffice'
-        'TrackClicks' = 'TrackClicks'
-        'AllowClickThrough' = 'AllowClickThrough'
-        'ScanUrls' = 'ScanUrls'
-        'EnableForInternalSenders' = 'EnableForInternalSenders'
-        'DeliverMessageAfterScan' = 'DeliverMessageAfterScan'
-        'DisableUrlRewrite' = 'DisableUrlRewrite'
-        'AdminDisplayName' = 'AdminDisplayName'
-        'CustomNotificationText' = 'CustomNotificationText'
+        'EnableSafeLinksForEmail'    = 'EnableSafeLinksForEmail'
+        'EnableSafeLinksForTeams'    = 'EnableSafeLinksForTeams'
+        'EnableSafeLinksForOffice'   = 'EnableSafeLinksForOffice'
+        'TrackClicks'                = 'TrackClicks'
+        'AllowClickThrough'          = 'AllowClickThrough'
+        'ScanUrls'                   = 'ScanUrls'
+        'EnableForInternalSenders'   = 'EnableForInternalSenders'
+        'DeliverMessageAfterScan'    = 'DeliverMessageAfterScan'
+        'DisableUrlRewrite'          = 'DisableUrlRewrite'
+        'AdminDisplayName'           = 'AdminDisplayName'
+        'CustomNotificationText'     = 'CustomNotificationText'
         'EnableOrganizationBranding' = 'EnableOrganizationBranding'
     }
 
@@ -249,11 +242,11 @@ function New-SafeLinksRuleParameters {
 
     # Array-based rule parameters
     $ArrayMappings = @{
-        'SentTo' = ConvertTo-SafeArray -Field $Template.SentTo
-        'SentToMemberOf' = ConvertTo-SafeArray -Field $Template.SentToMemberOf
-        'RecipientDomainIs' = ConvertTo-SafeArray -Field $Template.RecipientDomainIs
-        'ExceptIfSentTo' = ConvertTo-SafeArray -Field $Template.ExceptIfSentTo
-        'ExceptIfSentToMemberOf' = ConvertTo-SafeArray -Field $Template.ExceptIfSentToMemberOf
+        'SentTo'                    = ConvertTo-SafeArray -Field $Template.SentTo
+        'SentToMemberOf'            = ConvertTo-SafeArray -Field $Template.SentToMemberOf
+        'RecipientDomainIs'         = ConvertTo-SafeArray -Field $Template.RecipientDomainIs
+        'ExceptIfSentTo'            = ConvertTo-SafeArray -Field $Template.ExceptIfSentTo
+        'ExceptIfSentToMemberOf'    = ConvertTo-SafeArray -Field $Template.ExceptIfSentToMemberOf
         'ExceptIfRecipientDomainIs' = ConvertTo-SafeArray -Field $Template.ExceptIfRecipientDomainIs
     }
 
@@ -272,8 +265,8 @@ function Set-SafeLinksRuleState {
     if ($null -eq $State) { return }
 
     $IsEnabled = switch ($State) {
-        "Enabled" { $true }
-        "Disabled" { $false }
+        'Enabled' { $true }
+        'Disabled' { $false }
         $true { $true }
         $false { $false }
         default { $null }
@@ -282,7 +275,7 @@ function Set-SafeLinksRuleState {
     if ($null -ne $IsEnabled) {
         $Cmdlet = $IsEnabled ? 'Enable-SafeLinksRule' : 'Disable-SafeLinksRule'
         $null = New-ExoRequest -tenantid $Tenant -cmdlet $Cmdlet -cmdParams @{ Identity = $RuleName } -useSystemMailbox $true
-        return $IsEnabled ? "enabled" : "disabled"
+        return $IsEnabled ? 'enabled' : 'disabled'
     }
 
     return $null
@@ -320,8 +313,7 @@ function Invoke-SafeLinksRemediation {
                 $null = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeLinksPolicy' -cmdParams $PolicyParams -useSystemMailbox $true
                 $ActionsTaken.Add("Updated SafeLinks policy '$PolicyName'")
                 Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated SafeLinks policy '$PolicyName'" -sev Info
-            }
-            else {
+            } else {
                 # Create new policy
                 $PolicyParams['Name'] = $PolicyName
                 $null = New-ExoRequest -tenantid $Tenant -cmdlet 'New-SafeLinksPolicy' -cmdParams $PolicyParams -useSystemMailbox $true
@@ -338,8 +330,7 @@ function Invoke-SafeLinksRemediation {
                 $null = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-SafeLinksRule' -cmdParams $RuleParams -useSystemMailbox $true
                 $ActionsTaken.Add("Updated SafeLinks rule '$RuleName'")
                 Write-LogMessage -API 'Standards' -tenant $Tenant -message "Updated SafeLinks rule '$RuleName'" -sev Info
-            }
-            else {
+            } else {
                 # Create new rule
                 $RuleParams['Name'] = $RuleName
                 $RuleParams['SafeLinksPolicy'] = $PolicyName
@@ -356,21 +347,20 @@ function Invoke-SafeLinksRemediation {
             }
 
             $TemplateResults[$TemplateId] = @{
-                Success = $true
+                Success      = $true
                 ActionsTaken = $ActionsTaken.ToArray()
                 TemplateName = $Template.TemplateName ?? $Template.Name
-                PolicyName = $PolicyName
-                RuleName = $RuleName
+                PolicyName   = $PolicyName
+                RuleName     = $RuleName
             }
 
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully applied SafeLinks template '$($Template.TemplateName ?? $Template.Name)'" -sev Info
-        }
-        catch {
+        } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
             $TemplateResults[$TemplateId] = @{
-                Success = $false
-                Message = $ErrorMessage
-                TemplateName = $Template.TemplateName ?? $Template.Name ?? "Unknown"
+                Success      = $false
+                Message      = $ErrorMessage
+                TemplateName = $Template.TemplateName ?? $Template.Name ?? 'Unknown'
             }
             $OverallSuccess = $false
 
@@ -380,9 +370,8 @@ function Invoke-SafeLinksRemediation {
 
     # Report overall results
     if ($OverallSuccess) {
-        Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully applied all SafeLinks templates" -sev Info
-    }
-    else {
+        Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Successfully applied all SafeLinks templates' -sev Info
+    } else {
         $SuccessCount = ($TemplateResults.Values | Where-Object { $_.Success -eq $true }).Count
         $TotalCount = $TemplateList.Count
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Applied $SuccessCount out of $TotalCount SafeLinks templates" -sev Info
@@ -419,8 +408,7 @@ function Invoke-SafeLinksAlert {
 
                 $AlertMessages.Add($Status)
             }
-        }
-        catch {
+        } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
             $AlertMessages.Add("Failed to check template with ID $TemplateId : $ErrorMessage")
             $AllTemplatesApplied = $false
@@ -428,13 +416,12 @@ function Invoke-SafeLinksAlert {
     }
 
     if ($AllTemplatesApplied) {
-        Write-LogMessage -API 'Standards' -tenant $Tenant -message "All SafeLinks templates are correctly applied" -sev Info
-    }
-    else {
-        $AlertMessage = "One or more SafeLinks templates are not correctly applied: " + ($AlertMessages.ToArray() -join " | ")
+        Write-LogMessage -API 'Standards' -tenant $Tenant -message 'All SafeLinks templates are correctly applied' -sev Info
+    } else {
+        $AlertMessage = 'One or more SafeLinks templates are not correctly applied: ' + ($AlertMessages.ToArray() -join ' | ')
         Write-StandardsAlert -message $AlertMessage -object @{
             Templates = $TemplateList
-            Issues = $AlertMessages.ToArray()
+            Issues    = $AlertMessages.ToArray()
         } -tenant $Tenant -standardName 'SafeLinksTemplatePolicy' -standardId $Settings.standardId
 
         Write-LogMessage -API 'Standards' -tenant $Tenant -message $AlertMessage -sev Info
@@ -458,19 +445,18 @@ function Invoke-SafeLinksReport {
             $ExistingObjects = Get-ExistingSafeLinksObjects -Tenant $Tenant -PolicyName $PolicyName -RuleName $RuleName
 
             $ReportResults[$TemplateId] = @{
-                Success = ($ExistingObjects.PolicyExists -and $ExistingObjects.RuleExists)
+                Success      = ($ExistingObjects.PolicyExists -and $ExistingObjects.RuleExists)
                 TemplateName = $Template.TemplateName ?? $Template.Name
-                PolicyName = $PolicyName
-                RuleName = $RuleName
+                PolicyName   = $PolicyName
+                RuleName     = $RuleName
                 PolicyExists = [bool]$ExistingObjects.PolicyExists
-                RuleExists = [bool]$ExistingObjects.RuleExists
+                RuleExists   = [bool]$ExistingObjects.RuleExists
             }
 
             if (-not $ExistingObjects.PolicyExists -or -not $ExistingObjects.RuleExists) {
                 $AllTemplatesApplied = $false
             }
-        }
-        catch {
+        } catch {
             $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
             $ReportResults[$TemplateId] = @{
                 Success = $false
@@ -482,14 +468,18 @@ function Invoke-SafeLinksReport {
 
     Add-CIPPBPAField -FieldName 'SafeLinksTemplatePolicy' -FieldValue $AllTemplatesApplied -StoreAs bool -Tenant $Tenant
 
-    if ($AllTemplatesApplied) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.SafeLinksTemplatePolicy' -FieldValue $true -Tenant $Tenant
+    $CurrentValue = @{
+        TemplateResults     = $ReportResults
+        ProcessedTemplates  = $TemplateList.Count
+        SuccessfulTemplates = ($ReportResults.Values | Where-Object { $_.Success -eq $true }).Count
+        AllTemplatesApplied = $AllTemplatesApplied
     }
-    else {
-        Set-CIPPStandardsCompareField -FieldName 'standards.SafeLinksTemplatePolicy' -FieldValue @{
-            TemplateResults = $ReportResults
-            ProcessedTemplates = $TemplateList.Count
-            SuccessfulTemplates = ($ReportResults.Values | Where-Object { $_.Success -eq $true }).Count
-        } -Tenant $Tenant
+    $ExpectedValue = @{
+        TemplateResults     = $ReportResults
+        ProcessedTemplates  = $TemplateList.Count
+        SuccessfulTemplates = $TemplateList.Count
+        AllTemplatesApplied = $true
     }
+
+    Set-CIPPStandardsCompareField -FieldName 'standards.SafeLinksTemplatePolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1
index 74f06f4fa3fa..b879e3250c8d 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSafeSendersDisable.ps1
@@ -72,7 +72,13 @@ function Invoke-CIPPStandardSafeSendersDisable {
 
     if ($Settings.report -eq $true) {
         #This script always returns true, as it only disables the Safe Senders list
-        Set-CIPPStandardsCompareField -FieldName 'standards.SafeSendersDisable' -FieldValue $true -Tenant $Tenant
+        $CurrentValue = @{
+            SafeSendersDisabled = $true
+        }
+        $ExpectedValue = @{
+            SafeSendersDisabled = $true
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.SafeSendersDisable' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1
index 59d994b42f30..91e18f80dc42 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1
@@ -185,7 +185,14 @@ function Invoke-CIPPStandardSecureScoreRemediation {
             $ReportData = $true
         }
 
-        Set-CIPPStandardsCompareField -FieldName 'standards.SecureScoreRemediation' -FieldValue $ReportData -Tenant $tenant
+        $CurrentValue = @{
+            ControlsToUpdate = $ReportData
+        }
+        $ExpectedValue = @{
+            ControlsToUpdate = @()
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.SecureScoreRemediation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
         Add-CIPPBPAField -FieldName 'SecureScoreRemediation' -FieldValue $ReportData -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
index 6cda698e6143..bc5c73b053b5 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
@@ -34,8 +34,7 @@ function Invoke-CIPPStandardSecurityDefaults {
 
     try {
         $SecureDefaultsState = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy' -tenantid $tenant)
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the Security Defaults state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -70,6 +69,12 @@ function Invoke-CIPPStandardSecurityDefaults {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SecurityDefaults' -FieldValue $SecureDefaultsState.IsEnabled -StoreAs bool -Tenant $tenant
-        Set-CIPPStandardsCompareField -FieldName 'standards.SecurityDefaults' -FieldValue $SecureDefaultsState.IsEnabled -Tenant $tenant
+        $CurrentData = @{
+            SecurityDefaultsEnabled = $SecureDefaultsState.IsEnabled
+        }
+        $ExpectedData = @{
+            SecurityDefaultsEnabled = $true
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.SecurityDefaults' -CurrentValue $CurrentData -ExpectedValue $ExpectedData -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1
index 9aa1e244c5c7..4f2d624577b9 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1
@@ -40,8 +40,7 @@ function Invoke-CIPPStandardSendFromAlias {
 
     try {
         $CurrentInfo = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').SendFromAliasEnabled
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SendFromAlias state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -73,6 +72,12 @@ function Invoke-CIPPStandardSendFromAlias {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SendFromAlias' -FieldValue $CurrentInfo -StoreAs bool -Tenant $tenant
-        Set-CIPPStandardsCompareField -FieldName 'standards.SendFromAlias' -FieldValue $CurrentInfo -Tenant $tenant
+        $CurrentValue = @{
+            SendFromAliasEnabled = $CurrentInfo
+        }
+        $ExpectedValue = @{
+            SendFromAliasEnabled = $true
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.SendFromAlias' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
index 1ea8f1ff543f..be9fe0909549 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
@@ -109,11 +109,14 @@ function Invoke-CIPPStandardSendReceiveLimitTenant {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SendReceiveLimit' -FieldValue $NotSetCorrectly -StoreAs json -Tenant $tenant
 
-        if ($NotSetCorrectly.Count -eq 0) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $NotSetCorrectly
+        $CurrentValue = @{
+            SendLimit    = $Settings.SendLimit
+            ReceiveLimit = $Settings.ReceiveLimit
+        }
+        $ExpectedValue = @{
+            SendLimit    = $Settings.SendLimit
+            ReceiveLimit = $Settings.ReceiveLimit
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SendReceiveLimitTenant' -FieldValue $FieldValue -Tenant $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SendReceiveLimitTenant' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1
index 951c6e00b437..4891f990cf02 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1
@@ -44,10 +44,9 @@ function Invoke-CIPPStandardSharePointMassDeletionAlert {
 
     try {
         $CurrentState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-ProtectionAlert' -Compliance |
-        Where-Object { $_.Name -eq $PolicyName } |
-        Select-Object -Property *
-    }
-    catch {
+            Where-Object { $_.Name -eq $PolicyName } |
+            Select-Object -Property *
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the sharingCapability state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -115,8 +114,17 @@ function Invoke-CIPPStandardSharePointMassDeletionAlert {
     }
 
     if ($Settings.report -eq $true) {
-        $FieldValue = $StateIsCorrect ? $true : $CompareField
-        Set-CIPPStandardsCompareField -FieldName 'standards.SharePointMassDeletionAlert' -FieldValue $FieldValue -TenantFilter $Tenant
+        $CurrentValue = @{
+            Threshold  = $CurrentState.Threshold
+            TimeWindow = $CurrentState.TimeWindow
+            NotifyUser = @($CurrentState.NotifyUser)
+        }
+        $ExpectedValue = @{
+            Threshold  = $Settings.Threshold
+            TimeWindow = $Settings.TimeWindow
+            NotifyUser = @($Settings.NotifyUser.value)
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.SharePointMassDeletionAlert' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'SharePointMassDeletionAlert' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
index c0a703565124..b05f3abb32db 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
@@ -45,9 +45,8 @@ function Invoke-CIPPStandardShortenMeetings {
 
     try {
         $CurrentState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig' |
-        Select-Object -Property ShortenEventScopeDefault, DefaultMinutesToReduceShortEventsBy, DefaultMinutesToReduceLongEventsBy
-    }
-    catch {
+            Select-Object -Property ShortenEventScopeDefault, DefaultMinutesToReduceShortEventsBy, DefaultMinutesToReduceLongEventsBy
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the ShortenMeetings state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -96,11 +95,16 @@ function Invoke-CIPPStandardShortenMeetings {
             Add-CIPPBPAField @BPAField -StoreAs json
         }
 
-        if ($CorrectState -eq $true) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            ShortenEventScopeDefault            = $CurrentState.ShortenEventScopeDefault
+            DefaultMinutesToReduceShortEventsBy = $CurrentState.DefaultMinutesToReduceShortEventsBy
+            DefaultMinutesToReduceLongEventsBy  = $CurrentState.DefaultMinutesToReduceLongEventsBy
+        }
+        $ExpectedValue = @{
+            ShortenEventScopeDefault            = $scopeDefault
+            DefaultMinutesToReduceShortEventsBy = $Settings.DefaultMinutesToReduceShortEventsBy
+            DefaultMinutesToReduceLongEventsBy  = $Settings.DefaultMinutesToReduceLongEventsBy
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.ShortenMeetings' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.ShortenMeetings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1
index 68322ddf5b2a..5a9fd298f25c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1
@@ -64,10 +64,9 @@ function Invoke-CIPPStandardSpamFilterPolicy {
 
     try {
         $CurrentState = New-ExoRequest -TenantId $Tenant -cmdlet 'Get-HostedContentFilterPolicy' |
-        Where-Object -Property Name -EQ $PolicyName |
-        Select-Object -Property *
-    }
-    catch {
+            Where-Object -Property Name -EQ $PolicyName |
+            Select-Object -Property *
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SpamFilterPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -130,8 +129,7 @@ function Invoke-CIPPStandardSpamFilterPolicy {
         ($CurrentState.EnableRegionBlockList -eq $Settings.EnableRegionBlockList) -and
         ((($null -eq $CurrentState.RegionBlockList -or $CurrentState.RegionBlockList.Count -eq 0) -and ($null -eq $Settings.RegionBlockList.value)) -or ($null -ne $CurrentState.RegionBlockList -and $CurrentState.RegionBlockList.Count -gt 0 -and $null -ne $Settings.RegionBlockList.value -and !(Compare-Object -ReferenceObject $CurrentState.RegionBlockList -DifferenceObject $Settings.RegionBlockList.value))) -and
         ((($null -eq $CurrentState.AllowedSenderDomains -or $CurrentState.AllowedSenderDomains.Count -eq 0) -and ($null -eq ($Settings.AllowedSenderDomains.value ?? $Settings.AllowedSenderDomains))) -or ($null -ne $CurrentState.AllowedSenderDomains -and $CurrentState.AllowedSenderDomains.Count -gt 0 -and $null -ne ($Settings.AllowedSenderDomains.value ?? $Settings.AllowedSenderDomains) -and !(Compare-Object -ReferenceObject $CurrentState.AllowedSenderDomains -DifferenceObject ($Settings.AllowedSenderDomains.value ?? $Settings.AllowedSenderDomains))))
-    }
-    catch {
+    } catch {
         $StateIsCorrect = $false
     }
 
@@ -260,11 +258,58 @@ function Invoke-CIPPStandardSpamFilterPolicy {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SpamFilterPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $StateIsCorrect -eq $true ? $true : ($CurrentState ?? @{ state = 'Spam filter policy not found' })
+        $CurrentValue = @{
+            Name                             = $CurrentState.Name
+            SpamAction                       = $CurrentState.SpamAction
+            SpamQuarantineTag                = $CurrentState.SpamQuarantineTag
+            HighConfidenceSpamAction         = $CurrentState.HighConfidenceSpamAction
+            HighConfidenceSpamQuarantineTag  = $CurrentState.HighConfidenceSpamQuarantineTag
+            BulkSpamAction                   = $CurrentState.BulkSpamAction
+            BulkQuarantineTag                = $CurrentState.BulkQuarantineTag
+            PhishSpamAction                  = $CurrentState.PhishSpamAction
+            PhishQuarantineTag               = $CurrentState.PhishQuarantineTag
+            HighConfidencePhishQuarantineTag = $CurrentState.HighConfidencePhishQuarantineTag
+            BulkThreshold                    = $CurrentState.BulkThreshold
+            IncreaseScoreWithImageLinks      = $CurrentState.IncreaseScoreWithImageLinks
+            IncreaseScoreWithBizOrInfoUrls   = $CurrentState.IncreaseScoreWithBizOrInfoUrls
+            MarkAsSpamFramesInHtml           = $CurrentState.MarkAsSpamFramesInHtml
+            MarkAsSpamObjectTagsInHtml       = $CurrentState.MarkAsSpamObjectTagsInHtml
+            MarkAsSpamEmbedTagsInHtml        = $CurrentState.MarkAsSpamEmbedTagsInHtml
+            MarkAsSpamFormTagsInHtml         = $CurrentState.MarkAsSpamFormTagsInHtml
+            MarkAsSpamWebBugsInHtml          = $CurrentState.MarkAsSpamWebBugsInHtml
+            MarkAsSpamSensitiveWordList      = $CurrentState.MarkAsSpamSensitiveWordList
+            EnableLanguageBlockList          = $CurrentState.EnableLanguageBlockList
+            LanguageBlockList                = $CurrentState.LanguageBlockList
+            EnableRegionBlockList            = $CurrentState.EnableRegionBlockList
+            RegionBlockList                  = $CurrentState.RegionBlockList
+            AllowedSenderDomains             = $CurrentState.AllowedSenderDomains
+        }
+        $ExpectedValue = @{
+            Name                             = $PolicyName
+            SpamAction                       = $SpamAction
+            SpamQuarantineTag                = $SpamQuarantineTag
+            HighConfidenceSpamAction         = $HighConfidenceSpamAction
+            HighConfidenceSpamQuarantineTag  = $HighConfidenceSpamQuarantineTag
+            BulkSpamAction                   = $BulkSpamAction
+            BulkQuarantineTag                = $BulkQuarantineTag
+            PhishSpamAction                  = $PhishSpamAction
+            PhishQuarantineTag               = $PhishQuarantineTag
+            HighConfidencePhishQuarantineTag = $HighConfidencePhishQuarantineTag
+            BulkThreshold                    = [int]$Settings.BulkThreshold
+            IncreaseScoreWithImageLinks      = $IncreaseScoreWithImageLinks
+            IncreaseScoreWithBizOrInfoUrls   = $IncreaseScoreWithBizOrInfoUrls
+            MarkAsSpamFramesInHtml           = $MarkAsSpamFramesInHtml
+            MarkAsSpamObjectTagsInHtml       = $MarkAsSpamObjectTagsInHtml
+            MarkAsSpamEmbedTagsInHtml        = $MarkAsSpamEmbedTagsInHtml
+            MarkAsSpamFormTagsInHtml         = $MarkAsSpamFormTagsInHtml
+            MarkAsSpamWebBugsInHtml          = $MarkAsSpamWebBugsInHtml
+            MarkAsSpamSensitiveWordList      = $MarkAsSpamSensitiveWordList
+            EnableLanguageBlockList          = $Settings.EnableLanguageBlockList
+            LanguageBlockList                = if ($Settings.EnableLanguageBlockList -eq $true) { $Settings.LanguageBlockList.value } else { @() }
+            EnableRegionBlockList            = $Settings.EnableRegionBlockList
+            RegionBlockList                  = if ($Settings.EnableRegionBlockList -eq $true) { $Settings.RegionBlockList.value } else { @() }
+            AllowedSenderDomains             = $Settings.AllowedSenderDomains.value ?? @()
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SpamFilterPolicy' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SpamFilterPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
index 11676a8f2146..c07e9e96fb3f 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
@@ -132,11 +132,16 @@ function Invoke-CIPPStandardSpoofWarn {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'SpoofingWarnings' -FieldValue $CurrentInfo.Enabled -StoreAs bool -Tenant $Tenant
 
-        if ($AllowListCorrect -eq $true -and $CurrentInfo.Enabled -eq $IsEnabled) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentInfo | Select-Object Enabled, AllowList
+        $CurrentValue = @{
+            Enabled   = $CurrentInfo.Enabled
+            AllowList = $CurrentInfo.AllowList
+            IsCompliant = $CurrentInfo.Enabled -eq $IsEnabled -and $AllowListCorrect
+        }
+        $ExpectedValue = @{
+            Enabled   = $IsEnabled
+            AllowList = $Settings.AllowListAdd.value ?? $Settings.AllowListAdd
+            IsCompliant = $true
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.SpoofWarn' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.SpoofWarn' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1
index 8d95d769d8f1..87cd2d6b39e4 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1
@@ -47,8 +47,7 @@ function Invoke-CIPPStandardStaleEntraDevices {
 
     try {
         $AllDevices = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/devices' -tenantid $Tenant | Where-Object { $null -ne $_.approximateLastSignInDateTime }
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the StaleEntraDevices state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -98,6 +97,16 @@ function Invoke-CIPPStandardStaleEntraDevices {
         } else {
             $FieldValue = $true
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.StaleEntraDevices' -FieldValue $FieldValue -Tenant $Tenant
+        $CurrentValue = @{
+            StaleDevicesCount  = $StaleDevices.Count
+            StaleDevices       = @($FieldValue)
+            DeviceAgeThreshold = [int]$Settings.deviceAgeThreshold
+        }
+        $ExpectedValue = @{
+            StaleDevicesCount  = 0
+            StaleDevices       = @()
+            DeviceAgeThreshold = [int]$Settings.deviceAgeThreshold
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.StaleEntraDevices' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1
index 696ecfec1802..1d5dff424012 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTAP.ps1
@@ -32,12 +32,10 @@ function Invoke-CIPPStandardTAP {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TAP'
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/TemporaryAccessPass' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TAP state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -74,11 +72,14 @@ function Invoke-CIPPStandardTAP {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TemporaryAccessPass' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState | Select-Object state, isUsableOnce
+        $CurrentValue = @{
+            state        = $CurrentState.state
+            isUsableOnce = $CurrentState.isUsableOnce
+        }
+        $ExpectedValue = @{
+            state        = 'enabled'
+            isUsableOnce = [System.Convert]::ToBoolean($config)
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TAP' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TAP' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1
index 08c2a813cce6..06bd0ed34f07 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1
@@ -91,11 +91,14 @@ function Invoke-CIPPStandardTeamsChatProtection {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TeamsChatProtection' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            FileTypeCheck      = $CurrentState.FileTypeCheck
+            UrlReputationCheck = $CurrentState.UrlReputationCheck
+        }
+        $ExpectedValue = @{
+            FileTypeCheck      = $FileTypeCheckState
+            UrlReputationCheck = $UrlReputationCheckState
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsChatProtection' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsChatProtection' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1
index eb182da573dc..6cf019c7353e 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1
@@ -1,4 +1,4 @@
-Function Invoke-CIPPStandardTeamsEmailIntegration {
+function Invoke-CIPPStandardTeamsEmailIntegration {
     <#
     .FUNCTIONALITY
         Internal
@@ -33,8 +33,7 @@ Function Invoke-CIPPStandardTeamsEmailIntegration {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsEmailIntegration' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsEmailIntegration'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsEmailIntegration' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -43,9 +42,8 @@ Function Invoke-CIPPStandardTeamsEmailIntegration {
 
     try {
         $CurrentState = New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } |
-        Select-Object AllowEmailIntoChannel
-    }
-    catch {
+            Select-Object AllowEmailIntoChannel
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsEmailIntegration state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -85,12 +83,13 @@ Function Invoke-CIPPStandardTeamsEmailIntegration {
 
     if ($Settings.report -eq $true) {
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            AllowEmailIntoChannel = $CurrentState.AllowEmailIntoChannel
+        }
+        $ExpectedValue = @{
+            AllowEmailIntoChannel = $AllowEmailIntoChannel
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsEmailIntegration' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsEmailIntegration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'TeamsEmailIntoChannel' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1
index 1d0aa58d7626..ac908df686cb 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1
@@ -31,7 +31,7 @@ function Invoke-CIPPStandardTeamsEnrollUser {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsEnrollUser' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsEnrollUser' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     # Get EnrollUserOverride value using null-coalescing operator
 
@@ -43,9 +43,8 @@ function Invoke-CIPPStandardTeamsEnrollUser {
 
     try {
         $CurrentState = New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsTeamsMeetingPolicy' -cmdParams @{Identity = 'Global' } |
-        Select-Object EnrollUserOverride
-    }
-    catch {
+            Select-Object EnrollUserOverride
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsEnrollUser state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -84,11 +83,12 @@ function Invoke-CIPPStandardTeamsEnrollUser {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TeamsEnrollUser' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            EnrollUserOverride = $CurrentState.EnrollUserOverride
+        }
+        $ExpectedValue = @{
+            EnrollUserOverride = $enrollUserOverride
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsEnrollUser' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsEnrollUser' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1
index fe93267775aa..3b09e9240683 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1
@@ -32,8 +32,7 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsExternalAccessPolicy' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsExternalAccessPolicy'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsExternalAccessPolicy' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -42,9 +41,8 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy {
 
     try {
         $CurrentState = New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsExternalAccessPolicy' -CmdParams @{Identity = 'Global' } |
-        Select-Object *
-    }
-    catch {
+            Select-Object *
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsExternalAccessPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -88,12 +86,14 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TeamsExternalAccessPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect -eq $true) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState | Select-Object EnableFederationAccess, EnableTeamsConsumerAccess
+        $CurrentValue = @{
+            EnableFederationAccess    = $CurrentState.EnableFederationAccess
+            EnableTeamsConsumerAccess = $CurrentState.EnableTeamsConsumerAccess
         }
-
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalAccessPolicy' -FieldValue $FieldValue -Tenant $Tenant
+        $ExpectedValue = @{
+            EnableFederationAccess    = $EnableFederationAccess
+            EnableTeamsConsumerAccess = $EnableTeamsConsumerAccess
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalAccessPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1
index c6e38220857a..659a46c5d73a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1
@@ -83,11 +83,12 @@ function Invoke-CIPPStandardTeamsExternalChatWithAnyone {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TeamsExternalChatWithAnyone' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            UseB2BInvitesToAddExternalUsers = $CurrentState.UseB2BInvitesToAddExternalUsers
+        }
+        $ExpectedValue = @{
+            UseB2BInvitesToAddExternalUsers = $DesiredState
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalChatWithAnyone' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalChatWithAnyone' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1
index 9d101bb66f15..a24252704227 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1
@@ -37,8 +37,7 @@ function Invoke-CIPPStandardTeamsExternalFileSharing {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsExternalFileSharing' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsExternalFileSharing'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsExternalFileSharing' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -47,9 +46,8 @@ function Invoke-CIPPStandardTeamsExternalFileSharing {
 
     try {
         $CurrentState = New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsTeamsClientConfiguration' |
-        Select-Object AllowGoogleDrive, AllowShareFile, AllowBox, AllowDropBox, AllowEgnyte
-    }
-    catch {
+            Select-Object AllowGoogleDrive, AllowShareFile, AllowBox, AllowDropBox, AllowEgnyte
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsExternalFileSharing state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -96,11 +94,20 @@ function Invoke-CIPPStandardTeamsExternalFileSharing {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TeamsExternalFileSharing' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect -eq $true) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            AllowGoogleDrive = $CurrentState.AllowGoogleDrive
+            AllowShareFile   = $CurrentState.AllowShareFile
+            AllowBox         = $CurrentState.AllowBox
+            AllowDropBox     = $CurrentState.AllowDropBox
+            AllowEgnyte      = $CurrentState.AllowEgnyte
+        }
+        $ExpectedValue = @{
+            AllowGoogleDrive = $Settings.AllowGoogleDrive
+            AllowShareFile   = $Settings.AllowShareFile
+            AllowBox         = $Settings.AllowBox
+            AllowDropBox     = $Settings.AllowDropBox
+            AllowEgnyte      = $Settings.AllowEgnyte
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalFileSharing' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsExternalFileSharing' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
index 9aba0bc770c6..ee526b9037bb 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
@@ -34,7 +34,6 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
 
     param($Tenant, $Settings)
     $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsFederationConfiguration' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsFederationConfiguration'
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -144,11 +143,19 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'FederationConfiguration' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        if ($StateIsCorrect -eq $true) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState | Select-Object AllowTeamsConsumer, AllowFederatedUsers, AllowedDomains, BlockedDomains
+
+        $CurrentValue = @{
+            AllowTeamsConsumer  = $CurrentState.AllowTeamsConsumer
+            AllowFederatedUsers = $CurrentState.AllowFederatedUsers
+            AllowedDomains      = if ($CurrentAllowedDomains.GetType().Name -eq 'Deserialized.Microsoft.Rtc.Management.WritableConfig.Settings.Edge.AllowAllKnownDomains') { $CurrentAllowedDomains.ToString() } else { $CurrentAllowedDomains }
+            BlockedDomains      = $CurrentState.BlockedDomains
+        }
+        $ExpectedValue = @{
+            AllowTeamsConsumer  = $Settings.AllowTeamsConsumer
+            AllowFederatedUsers = $AllowFederatedUsers
+            AllowedDomains      = $AllowedDomains
+            BlockedDomains      = $BlockedDomains
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsFederationConfiguration' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsFederationConfiguration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1
index 8d8a2255f866..163e626da422 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1
@@ -40,8 +40,6 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy {
     .LINK
         https://docs.cipp.app/user-documentation/tenant/standards/list-standards
     #>
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsGlobalMeetingPolicy'
-
     param($Tenant, $Settings)
     $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsGlobalMeetingPolicy' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
@@ -108,12 +106,25 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy {
 
     if ($Settings.report -eq $true) {
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            AllowAnonymousUsersToJoinMeeting           = $CurrentState.AllowAnonymousUsersToJoinMeeting
+            AllowAnonymousUsersToStartMeeting          = $CurrentState.AllowAnonymousUsersToStartMeeting
+            AutoAdmittedUsers                          = $CurrentState.AutoAdmittedUsers
+            AllowPSTNUsersToBypassLobby                = $CurrentState.AllowPSTNUsersToBypassLobby
+            MeetingChatEnabledType                     = $CurrentState.MeetingChatEnabledType
+            DesignatedPresenterRoleMode                = $CurrentState.DesignatedPresenterRoleMode
+            AllowExternalParticipantGiveRequestControl = $CurrentState.AllowExternalParticipantGiveRequestControl
+        }
+        $ExpectedValue = @{
+            AllowAnonymousUsersToJoinMeeting           = $Settings.AllowAnonymousUsersToJoinMeeting
+            AllowAnonymousUsersToStartMeeting          = $false
+            AutoAdmittedUsers                          = $AutoAdmittedUsers
+            AllowPSTNUsersToBypassLobby                = $false
+            MeetingChatEnabledType                     = $MeetingChatEnabledType
+            DesignatedPresenterRoleMode                = $DesignatedPresenterRoleMode
+            AllowExternalParticipantGiveRequestControl = $Settings.AllowExternalParticipantGiveRequestControl
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsGlobalMeetingPolicy' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsGlobalMeetingPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'TeamsGlobalMeetingPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1
index bef968173610..3c5c3d6336f9 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1
@@ -31,7 +31,7 @@ function Invoke-CIPPStandardTeamsGuestAccess {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsGuestAccess' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsGuestAccess' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -40,9 +40,8 @@ function Invoke-CIPPStandardTeamsGuestAccess {
 
     try {
         $CurrentState = New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsTeamsClientConfiguration' -CmdParams @{Identity = 'Global' } |
-        Select-Object AllowGuestUser
-    }
-    catch {
+            Select-Object AllowGuestUser
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsGuestAccess state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -81,12 +80,13 @@ function Invoke-CIPPStandardTeamsGuestAccess {
     }
 
     if ($Settings.report -eq $true) {
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            AllowGuestUser = $CurrentState.AllowGuestUser
+        }
+        $ExpectedValue = @{
+            AllowGuestUser = $AllowGuestUser
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsGuestAccess' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsGuestAccess' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'TeamsGuestAccess' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1
index 662046683c77..9004c3de2b30 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1
@@ -29,10 +29,9 @@ function Invoke-CIPPStandardTeamsMeetingRecordingExpiration {
     .LINK
         https://docs.cipp.app/user-documentation/tenant/standards/list-standards
     #>
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsMeetingRecordingExpiration'
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsMeetingRecordingExpiration' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsMeetingRecordingExpiration' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     # Input validation
 
@@ -48,8 +47,7 @@ function Invoke-CIPPStandardTeamsMeetingRecordingExpiration {
 
     try {
         $CurrentExpirationDays = (New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsTeamsMeetingPolicy' -CmdParams @{Identity = 'Global' }).NewMeetingRecordingExpirationDays
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsMeetingRecordingExpiration state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -90,7 +88,12 @@ function Invoke-CIPPStandardTeamsMeetingRecordingExpiration {
         Add-CIPPBPAField -FieldName 'TeamsMeetingRecordingExpiration' -FieldValue $CurrentExpirationDays -StoreAs string -Tenant $Tenant
 
         $CurrentExpirationDays = if ($StateIsCorrect) { $true } else { $CurrentExpirationDays }
-
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMeetingRecordingExpiration' -FieldValue $CurrentExpirationDays -Tenant $Tenant
+        $CurrentValue = @{
+            MeetingRecordingExpirationDays = $CurrentExpirationDays
+        }
+        $ExpectedValue = @{
+            MeetingRecordingExpirationDays = $ExpirationDays
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMeetingRecordingExpiration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1
index ed238109defc..119e3a0af58a 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1
@@ -30,10 +30,9 @@ function Invoke-CIPPStandardTeamsMeetingVerification {
     .LINK
         https://docs.cipp.app/user-documentation/tenant/standards/list-standards
     #>
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsMeetingVerification'
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsMeetingVerification' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsMeetingVerification' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -42,9 +41,8 @@ function Invoke-CIPPStandardTeamsMeetingVerification {
 
     try {
         $CurrentState = New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsTeamsMeetingPolicy' -CmdParams @{Identity = 'Global' } |
-        Select-Object CaptchaVerificationForMeetingJoin
-    }
-    catch {
+            Select-Object CaptchaVerificationForMeetingJoin
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsMeetingVerification state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -58,7 +56,7 @@ function Invoke-CIPPStandardTeamsMeetingVerification {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Teams Meeting Verification Policy already set.' -sev Info
         } else {
             $cmdParams = @{
-                Identity                         = 'Global'
+                Identity                          = 'Global'
                 CaptchaVerificationForMeetingJoin = $CaptchaVerificationForMeetingJoin
             }
 
@@ -82,12 +80,13 @@ function Invoke-CIPPStandardTeamsMeetingVerification {
     }
 
     if ($Settings.report -eq $true) {
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentState = @{
+            CaptchaVerificationForMeetingJoin = $CurrentState.CaptchaVerificationForMeetingJoin
+        }
+        $ExpectedState = @{
+            CaptchaVerificationForMeetingJoin = $CaptchaVerificationForMeetingJoin
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMeetingVerification' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMeetingVerification' -CurrentValue $CurrentState -ExpectedValue $ExpectedState -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'TeamsMeetingVerification' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
index b595ba79dabf..38cb28d5efae 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
@@ -37,15 +37,13 @@ function Invoke-CIPPStandardTeamsMeetingsByDefault {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsMeetingsByDefault'
 
     # Get state value using null-coalescing operator
     $state = $Settings.state.value ?? $Settings.state
 
     try {
         $CurrentState = (New-ExoRequest -tenantid $Tenant -cmdlet 'Get-OrganizationConfig').OnlineMeetingsByDefaultEnabled
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsMeetingsByDefault state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -89,11 +87,13 @@ function Invoke-CIPPStandardTeamsMeetingsByDefault {
         # Default is not set, not set means it's enabled
         if ($null -eq $CurrentState ) { $CurrentState = $true }
         Add-CIPPBPAField -FieldName 'TeamsMeetingsByDefault' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+
+        $CurrentValue = @{
+            OnlineMeetingsByDefaultEnabled = $CurrentState
+        }
+        $ExpectedValue = @{
+            OnlineMeetingsByDefaultEnabled = $WantedState
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMeetingsByDefault' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMeetingsByDefault' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1
index 8b6a11935043..d2c938e26366 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1
@@ -1,4 +1,4 @@
-Function Invoke-CIPPStandardTeamsMessagingPolicy {
+function Invoke-CIPPStandardTeamsMessagingPolicy {
     <#
     .FUNCTIONALITY
         Internal
@@ -37,10 +37,9 @@ Function Invoke-CIPPStandardTeamsMessagingPolicy {
     .LINK
         https://docs.cipp.app/user-documentation/tenant/standards/list-standards
     #>
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TeamsMessagingPolicy'
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsMessagingPolicy' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1','Teams_Room_Standard')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TeamsMessagingPolicy' -TenantFilter $Tenant -RequiredCapabilities @('MCOSTANDARD', 'MCOEV', 'MCOIMP', 'TEAMS1', 'Teams_Room_Standard')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -49,8 +48,7 @@ Function Invoke-CIPPStandardTeamsMessagingPolicy {
 
     try {
         $CurrentState = New-TeamsRequest -TenantFilter $Tenant -Cmdlet 'Get-CsTeamsMessagingPolicy' -CmdParams @{Identity = 'Global' }
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TeamsMessagingPolicy state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -68,14 +66,14 @@ Function Invoke-CIPPStandardTeamsMessagingPolicy {
     $ReadReceiptsEnabledType = $Settings.ReadReceiptsEnabledType.value ?? $Settings.ReadReceiptsEnabledType
 
     $StateIsCorrect = ($CurrentState.AllowOwnerDeleteMessage -eq $Settings.AllowOwnerDeleteMessage) -and
-                        ($CurrentState.AllowUserDeleteMessage -eq $Settings.AllowUserDeleteMessage) -and
-                        ($CurrentState.AllowUserEditMessage -eq $Settings.AllowUserEditMessage) -and
-                        ($CurrentState.AllowUserDeleteChat -eq $Settings.AllowUserDeleteChat) -and
-                        ($CurrentState.ReadReceiptsEnabledType -eq $ReadReceiptsEnabledType) -and
-                        ($CurrentState.CreateCustomEmojis -eq $Settings.CreateCustomEmojis) -and
-                        ($CurrentState.DeleteCustomEmojis -eq $Settings.DeleteCustomEmojis) -and
-                        ($CurrentState.AllowSecurityEndUserReporting -eq $Settings.AllowSecurityEndUserReporting) -and
-                        ($CurrentState.AllowCommunicationComplianceEndUserReporting -eq $Settings.AllowCommunicationComplianceEndUserReporting)
+    ($CurrentState.AllowUserDeleteMessage -eq $Settings.AllowUserDeleteMessage) -and
+    ($CurrentState.AllowUserEditMessage -eq $Settings.AllowUserEditMessage) -and
+    ($CurrentState.AllowUserDeleteChat -eq $Settings.AllowUserDeleteChat) -and
+    ($CurrentState.ReadReceiptsEnabledType -eq $ReadReceiptsEnabledType) -and
+    ($CurrentState.CreateCustomEmojis -eq $Settings.CreateCustomEmojis) -and
+    ($CurrentState.DeleteCustomEmojis -eq $Settings.DeleteCustomEmojis) -and
+    ($CurrentState.AllowSecurityEndUserReporting -eq $Settings.AllowSecurityEndUserReporting) -and
+    ($CurrentState.AllowCommunicationComplianceEndUserReporting -eq $Settings.AllowCommunicationComplianceEndUserReporting)
 
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
@@ -108,7 +106,7 @@ Function Invoke-CIPPStandardTeamsMessagingPolicy {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Global Teams messaging policy is configured correctly.' -sev Info
         } else {
-            Write-StandardsAlert -message "Global Teams messaging policy is not configured correctly." -object $CurrentState -tenant $Tenant -standardName 'TeamsMessagingPolicy' -standardId $Settings.standardId
+            Write-StandardsAlert -message 'Global Teams messaging policy is not configured correctly.' -object $CurrentState -tenant $Tenant -standardName 'TeamsMessagingPolicy' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Global Teams messaging policy is not configured correctly.' -sev Info
         }
     }
@@ -116,11 +114,28 @@ Function Invoke-CIPPStandardTeamsMessagingPolicy {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TeamsMessagingPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            AllowOwnerDeleteMessage                      = $CurrentState.AllowOwnerDeleteMessage
+            AllowUserDeleteMessage                       = $CurrentState.AllowUserDeleteMessage
+            AllowUserEditMessage                         = $CurrentState.AllowUserEditMessage
+            AllowUserDeleteChat                          = $CurrentState.AllowUserDeleteChat
+            ReadReceiptsEnabledType                      = $CurrentState.ReadReceiptsEnabledType
+            CreateCustomEmojis                           = $CurrentState.CreateCustomEmojis
+            DeleteCustomEmojis                           = $CurrentState.DeleteCustomEmojis
+            AllowSecurityEndUserReporting                = $CurrentState.AllowSecurityEndUserReporting
+            AllowCommunicationComplianceEndUserReporting = $CurrentState.AllowCommunicationComplianceEndUserReporting
+        }
+        $ExpectedValue = @{
+            AllowOwnerDeleteMessage                      = $Settings.AllowOwnerDeleteMessage
+            AllowUserDeleteMessage                       = $Settings.AllowUserDeleteMessage
+            AllowUserEditMessage                         = $Settings.AllowUserEditMessage
+            AllowUserDeleteChat                          = $Settings.AllowUserDeleteChat
+            ReadReceiptsEnabledType                      = $ReadReceiptsEnabledType
+            CreateCustomEmojis                           = $Settings.CreateCustomEmojis
+            DeleteCustomEmojis                           = $Settings.DeleteCustomEmojis
+            AllowSecurityEndUserReporting                = $Settings.AllowSecurityEndUserReporting
+            AllowCommunicationComplianceEndUserReporting = $Settings.AllowCommunicationComplianceEndUserReporting
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMessagingPolicy' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMessagingPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
index e930f7ef6fa7..265ff6116e17 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
@@ -31,8 +31,7 @@ function Invoke-CIPPStandardTenantDefaultTimezone {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'TenantDefaultTimezone' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TenantDefaultTimezone'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'TenantDefaultTimezone' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -41,8 +40,7 @@ function Invoke-CIPPStandardTenantDefaultTimezone {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the TenantDefaultTimezone state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -82,11 +80,12 @@ function Invoke-CIPPStandardTenantDefaultTimezone {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'TenantDefaultTimezone' -FieldValue $CurrentState.tenantDefaultTimezone -StoreAs string -Tenant $Tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState | Select-Object tenantDefaultTimezone
+        $CurrentValue = @{
+            tenantDefaultTimezone = $CurrentState.tenantDefaultTimezone
+        }
+        $ExpectedValue = @{
+            tenantDefaultTimezone = $ExpectedTimezone
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.TenantDefaultTimezone' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TenantDefaultTimezone' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
index 52bf5c0dcba0..9e645e6597cd 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTransportRuleTemplate.ps1
@@ -34,7 +34,7 @@ function Invoke-CIPPStandardTransportRuleTemplate {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TransportRuleTemplate'
+
     $existingRules = New-ExoRequest -ErrorAction SilentlyContinue -tenantid $Tenant -cmdlet 'Get-TransportRule' -useSystemMailbox $true
     if ($Settings.remediate -eq $true) {
         Write-Host "Settings: $($Settings | ConvertTo-Json)"
@@ -49,9 +49,13 @@ function Invoke-CIPPStandardTransportRuleTemplate {
             try {
                 if ($Existing) {
                     Write-Host 'Found existing'
-                    $RequestParams | Add-Member -NotePropertyValue $RequestParams.name -NotePropertyName Identity
-                    $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
-                    Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set transport rule for $tenant" -sev 'Info'
+                    if ($Settings.overwrite) {
+                        $RequestParams | Add-Member -NotePropertyValue $RequestParams.name -NotePropertyName Identity
+                        $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
+                        Write-LogMessage -API 'Standards' -tenant $tenant -message "Successfully set transport rule for $tenant" -sev 'Info'
+                    } else {
+                        Write-LogMessage -API 'Standards' -tenant $tenant -message "Skipping transport rule for $tenant as it already exists" -sev 'Info'
+                    }
                 } else {
                     Write-Host 'Creating new'
                     $GraphRequest = New-ExoRequest -tenantid $Tenant -cmdlet 'New-TransportRule' -cmdParams ($RequestParams | Select-Object -Property * -ExcludeProperty GUID, Comments, HasSenderOverride, ExceptIfHasSenderOverride, ExceptIfMessageContainsDataClassifications, MessageContainsDataClassifications, UseLegacyRegex) -useSystemMailbox $true
@@ -74,12 +78,15 @@ function Invoke-CIPPStandardTransportRuleTemplate {
             }
         }
 
-        if ($MissingRules.Count -eq 0) {
-            $fieldValue = $true
-        } else {
-            $fieldValue = $MissingRules -join ', '
+        $CurrentValue = @{
+            DeployedTransportRules = $existingRules.DisplayName | Where-Object { $rules.displayname -contains $_ } | Sort-Object
+            MissingTransportRules  = $MissingRules
+        }
+        $ExpectedValue = @{
+            DeployedTransportRules = $rules.displayname | Sort-Object
+            MissingTransportRules  = @()
         }
 
-        Set-CIPPStandardsCompareField -FieldName 'standards.TransportRuleTemplate' -FieldValue $fieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.TransportRuleTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1
index 6c5edef137fe..3368eaa5be6c 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1
@@ -37,7 +37,6 @@ function Invoke-CIPPStandardTwoClickEmailProtection {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'TwoClickEmailProtection'
 
     # Get state value using null-coalescing operator
     $State = $Settings.state.value ?? $Settings.state
@@ -45,7 +44,7 @@ function Invoke-CIPPStandardTwoClickEmailProtection {
     # Input validation
     if ([string]::IsNullOrWhiteSpace($State)) {
         Write-LogMessage -API 'Standards' -tenant $Tenant -message 'TwoClickEmailProtection: Invalid state parameter set' -sev Error
-        Return
+        return
     }
 
     try {
@@ -53,7 +52,7 @@ function Invoke-CIPPStandardTwoClickEmailProtection {
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Standards' -tenant $Tenant -message "Could not get current two-click email protection state. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
-        Return
+        return
     }
 
     $WantedState = $State -eq 'enabled' ? $true : $false
@@ -86,7 +85,13 @@ function Invoke-CIPPStandardTwoClickEmailProtection {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.TwoClickEmailProtection' -FieldValue $StateIsCorrect -Tenant $Tenant
+        $CurrentValue = @{
+            TwoClickMailPreviewEnabled = $CurrentState
+        }
+        $ExpectedValue = @{
+            TwoClickMailPreviewEnabled = $WantedState
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.TwoClickEmailProtection' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'TwoClickEmailProtection' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1
index 96d2bed4cf05..9d292ddeb938 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1
@@ -30,12 +30,10 @@ function Invoke-CIPPStandardUndoOauth {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'UndoOauth'
 
     try {
         $CurrentState = New-GraphGetRequest -tenantid $Tenant -Uri 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy?$select=permissionGrantPolicyIdsAssignedToDefaultUserRole'
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the App Consent state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -43,23 +41,23 @@ function Invoke-CIPPStandardUndoOauth {
 
     $StateIsCorrect = ($CurrentState.permissionGrantPolicyIdsAssignedToDefaultUserRole -eq 'ManagePermissionGrantsForSelf.microsoft-user-default-legacy')
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Application Consent Mode is already disabled.' -sev Info
         } else {
             try {
                 $GraphRequest = @{
-                    tenantid = $tenant
-                    uri = 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy'
-                    AsApp = $false
-                    Type = 'PATCH'
+                    tenantid    = $tenant
+                    uri         = 'https://graph.microsoft.com/beta/policies/authorizationPolicy/authorizationPolicy'
+                    AsApp       = $false
+                    Type        = 'PATCH'
                     ContentType = 'application/json'
-                    Body = '{"permissionGrantPolicyIdsAssignedToDefaultUserRole":["ManagePermissionGrantsForSelf.microsoft-user-default-legacy"]}'
+                    Body        = '{"permissionGrantPolicyIdsAssignedToDefaultUserRole":["ManagePermissionGrantsForSelf.microsoft-user-default-legacy"]}'
                 }
                 New-GraphPostRequest @GraphRequest
                 Write-LogMessage -API 'Standards' -tenant $tenant -message 'Application Consent Mode has been disabled.' -sev Info
             } catch {
-                Write-LogMessage -API 'Standards' -tenant $tenant -message "Failed to set Application Consent Mode to disabled." -sev Error -LogData $_
+                Write-LogMessage -API 'Standards' -tenant $tenant -message 'Failed to set Application Consent Mode to disabled.' -sev Error -LogData $_
             }
         }
 
@@ -69,18 +67,19 @@ function Invoke-CIPPStandardUndoOauth {
         if ($StateIsCorrect -eq $true) {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Application Consent Mode is disabled.' -sev Info
         } else {
-            Write-StandardsAlert -message "Application Consent Mode is not disabled." -object $CurrentState -tenant $Tenant -standardName 'UndoOauth' -standardId $Settings.standardId
+            Write-StandardsAlert -message 'Application Consent Mode is not disabled.' -object $CurrentState -tenant $Tenant -standardName 'UndoOauth' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Application Consent Mode is not disabled.' -sev Info
         }
     }
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'UndoOauth' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
+        $CurrentValue = @{
+            permissionGrantPolicyIdsAssignedToDefaultUserRole = $CurrentState.permissionGrantPolicyIdsAssignedToDefaultUserRole
+        }
+        $ExpectedValue = @{
+            permissionGrantPolicyIdsAssignedToDefaultUserRole = @('ManagePermissionGrantsForSelf.microsoft-user-default-legacy')
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.UndoOauth' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.UndoOauth' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1
index f203d1a427d1..5c18d9d18d94 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1
@@ -34,8 +34,7 @@ function Invoke-CIPPStandardUserPreferredLanguage {
 
     try {
         $IncorrectUsers = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=999&`$select=userPrincipalName,displayName,preferredLanguage,userType,onPremisesSyncEnabled&`$filter=preferredLanguage ne '$preferredLanguage' and userType eq 'Member' and onPremisesSyncEnabled ne true&`$count=true" -tenantid $Tenant -ComplexFilter
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the UserPreferredLanguage state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -77,11 +76,16 @@ function Invoke-CIPPStandardUserPreferredLanguage {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'IncorrectUsers' -FieldValue $IncorrectUsers -StoreAs json -Tenant $Tenant
 
-        if ($IncorrectUsers.userPrincipalName) {
-            $FieldValue = $IncorrectUsers | Select-Object -Property userPrincipalName, displayName, preferredLanguage, userType
-        } else {
-            $FieldValue = $true
+        if ($IncorrectUsers.userPrincipalName) { $FieldValue = $IncorrectUsers | Select-Object -Property userPrincipalName, displayName, preferredLanguage, userType } else { $FieldValue = @() }
+
+        $CurrentValue = @{
+            preferredLanguage = $preferredLanguage
+            incorrectUsers    = $FieldValue
+        }
+        $ExpectedValue = @{
+            preferredLanguage = $preferredLanguage
+            incorrectUsers    = @()
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.UserPreferredLanguage' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.UserPreferredLanguage' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
index 37dab2d39c17..f2867357c2f8 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
@@ -38,7 +38,6 @@ function Invoke-CIPPStandardUserSubmissions {
         Write-Host "We're exiting as the correct license is not present for this standard."
         return $true
     } #we're done.
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'UserSubmissions'
 
     # Get state value using null-coalescing operator
     $state = $Settings.state.value ?? $Settings.state
@@ -62,8 +61,7 @@ function Invoke-CIPPStandardUserSubmissions {
     try {
         $PolicyState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-ReportSubmissionPolicy'
         $RuleState = New-ExoRequest -tenantid $Tenant -cmdlet 'Get-ReportSubmissionRule'
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the UserSubmissions state for $Tenant. Error: $ErrorMessage" -Sev Error
     }
@@ -199,7 +197,6 @@ function Invoke-CIPPStandardUserSubmissions {
         }
     }
 
-
     if ($Settings.report -eq $true) {
         if ($PolicyState.length -eq 0) {
             Add-CIPPBPAField -FieldName 'UserSubmissionPolicy' -FieldValue $false -StoreAs bool -Tenant $Tenant
@@ -207,14 +204,42 @@ function Invoke-CIPPStandardUserSubmissions {
             Add-CIPPBPAField -FieldName 'UserSubmissionPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
         }
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $PolicyState = $PolicyState | Select-Object EnableReportToMicrosoft, ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, ReportPhishToCustomizedAddress, ReportJunkAddresses, ReportNotJunkAddresses, ReportPhishAddresses
-            $RuleState = $RuleState | Select-Object State, SentTo
-            $FieldValue = @{ PolicyState = $PolicyState; RuleState = $RuleState }
+        $PolicyState = $PolicyState | Select-Object EnableReportToMicrosoft, ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, ReportPhishToCustomizedAddress, ReportJunkAddresses, ReportNotJunkAddresses, ReportPhishAddresses
+        $RuleState = $RuleState | Select-Object State, SentTo
+
+        $CurrentValue = @{
+            EnableReportToMicrosoft          = $PolicyState.EnableReportToMicrosoft
+            ReportJunkToCustomizedAddress    = $PolicyState.ReportJunkToCustomizedAddress
+            ReportNotJunkToCustomizedAddress = $PolicyState.ReportNotJunkToCustomizedAddress
+            ReportPhishToCustomizedAddress   = $PolicyState.ReportPhishToCustomizedAddress
+            ReportJunkAddresses              = $PolicyState.ReportJunkAddresses
+            ReportNotJunkAddresses           = $PolicyState.ReportNotJunkAddresses
+            ReportPhishAddresses             = $PolicyState.ReportPhishAddresses
+            RuleState                        = @{
+                State  = $RuleState.State
+                SentTo = $RuleState.SentTo
+            }
         }
-
-        Set-CIPPStandardsCompareField -FieldName 'standards.UserSubmissions' -FieldValue $FieldValue -TenantFilter $Tenant
+        $ExpectedValue = @{
+            EnableReportToMicrosoft          = $state -eq 'enable'
+            ReportJunkToCustomizedAddress    = if ([string]::IsNullOrWhiteSpace($Email)) { $false } else { $true }
+            ReportNotJunkToCustomizedAddress = if ([string]::IsNullOrWhiteSpace($Email)) { $false } else { $true }
+            ReportPhishToCustomizedAddress   = if ([string]::IsNullOrWhiteSpace($Email)) { $false } else { $true }
+            ReportJunkAddresses              = if ([string]::IsNullOrWhiteSpace($Email)) { $null } else { $Email }
+            ReportNotJunkAddresses           = if ([string]::IsNullOrWhiteSpace($Email)) { $null } else { $Email }
+            ReportPhishAddresses             = if ([string]::IsNullOrWhiteSpace($Email)) { $null } else { $Email }
+            RuleState                        = if ([string]::IsNullOrWhiteSpace($Email)) {
+                @{
+                    State  = 'Disabled'
+                    SentTo = $null
+                }
+            } else {
+                @{
+                    State  = 'Enabled'
+                    SentTo = $Email
+                }
+            }
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.UserSubmissions' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
index 748567ac2da1..d2022ada13c4 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
@@ -42,6 +42,8 @@ function Invoke-CIPPStandardallowOAuthTokens {
         return
     }
     $StateIsCorrect = ($CurrentState.state -eq 'enabled')
+    $CurrentValue = $CurrentState | Select-Object -Property state
+    $ExpectedValue = [PSCustomObject]@{state = 'enabled' }
 
     if ($Settings.remediate -eq $true) {
         if ($StateIsCorrect -eq $true) {
@@ -65,6 +67,6 @@ function Invoke-CIPPStandardallowOAuthTokens {
 
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'softwareOath' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
-        Set-CIPPStandardsCompareField -FieldName 'standards.allowOAuthTokens' -FieldValue $StateIsCorrect -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.allowOAuthTokens' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
index a8a7037a8b84..acfdcc29a911 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
@@ -41,6 +41,9 @@ function Invoke-CIPPStandardallowOTPTokens {
         return
     }
 
+    $CurrentValue = $CurrentInfo | Select-Object -Property isSoftwareOathEnabled
+    $ExpectedValue = [PSCustomObject]@{isSoftwareOathEnabled = $true }
+
     if ($Settings.remediate -eq $true) {
         if ($CurrentInfo.isSoftwareOathEnabled) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message 'MS authenticator OTP/oAuth tokens is already enabled.' -sev Info
@@ -62,7 +65,7 @@ function Invoke-CIPPStandardallowOTPTokens {
     }
 
     if ($Settings.report -eq $true) {
-        Set-CIPPStandardsCompareField -FieldName 'standards.allowOTPTokens' -FieldValue $CurrentInfo.isSoftwareOathEnabled -TenantFilter $tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.allowOTPTokens' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
         Add-CIPPBPAField -FieldName 'MSAuthenticator' -FieldValue $CurrentInfo.isSoftwareOathEnabled -StoreAs bool -Tenant $tenant
     }
 
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
index 5926d094622f..193addccbdc1 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
@@ -115,8 +115,5 @@ function Invoke-CIPPStandardcalDefault {
 
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Successfully set default calendar permissions for $SuccessCounter out of $TotalMailboxes mailboxes." -sev Info
         }
-        if ($Settings.report -eq $true) {
-            #This script always returns true, as it only disables the Safe Senders list
-            Set-CIPPStandardsCompareField -FieldName 'standards.SafeSendersDisable' -FieldValue $true -Tenant $Tenant
-        }
+
     }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
index d5a024756ccc..df8b04ecfdeb 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
@@ -30,8 +30,7 @@ function Invoke-CIPPStandarddisableMacSync {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'disableMacSync' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'disableMacSync'
+    $TestResult = Test-CIPPStandardLicense -StandardName 'disableMacSync' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -40,14 +39,13 @@ function Invoke-CIPPStandarddisableMacSync {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableMacSync state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         if ($CurrentInfo.isMacSyncAppEnabled -eq $true) {
             try {
@@ -74,8 +72,16 @@ function Invoke-CIPPStandarddisableMacSync {
     }
 
     if ($Settings.report -eq $true) {
-        $CurrentInfo.isMacSyncAppEnabled = -not $CurrentInfo.isMacSyncAppEnabled
-        Set-CIPPStandardsCompareField -FieldName 'standards.disableMacSync' -FieldValue $CurrentInfo.isMacSyncAppEnabled -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'MacSync' -FieldValue $CurrentInfo.isMacSyncAppEnabled -StoreAs bool -Tenant $tenant
+        $CurrentState = -not $CurrentInfo.isMacSyncAppEnabled
+
+        $CurrentValue = [PSCustomObject]@{
+            MacSyncDisabled = $CurrentState
+        }
+        $ExpectedValue = [PSCustomObject]@{
+            MacSyncDisabled = $true
+        }
+
+        Set-CIPPStandardsCompareField -FieldName 'standards.disableMacSync' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
+        Add-CIPPBPAField -FieldName 'MacSync' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
index ff2d5495278a..cd36588ae4ad 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
@@ -41,7 +41,6 @@ function Invoke-CIPPStandardintuneBrandingProfile {
 
     param($Tenant, $Settings)
     $TestResult = Test-CIPPStandardLicense -StandardName 'intuneBrandingProfile' -TenantFilter $Tenant -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'intuneBrandingProfile'
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -50,8 +49,7 @@ function Invoke-CIPPStandardintuneBrandingProfile {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceManagement/intuneBrandingProfiles/c3a59481-1bf2-46ce-94b3-66eec07a8d60' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the intuneBrandingProfile state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -113,8 +111,31 @@ function Invoke-CIPPStandardintuneBrandingProfile {
     }
 
     if ($Settings.report -eq $true) {
-        $ReportState = $StateIsCorrect ? $true : $CurrentState
-        Set-CIPPStandardsCompareField -FieldName 'standards.intuneBrandingProfile' -FieldValue $ReportState -TenantFilter $Tenant
+        $CurrentValue = @{
+            displayName               = $CurrentState.displayName
+            showLogo                  = $CurrentState.showLogo
+            showDisplayNameNextToLogo = $CurrentState.showDisplayNameNextToLogo
+            contactITName             = $CurrentState.contactITName
+            contactITPhoneNumber      = $CurrentState.contactITPhoneNumber
+            contactITEmailAddress     = $CurrentState.contactITEmailAddress
+            contactITNotes            = $CurrentState.contactITNotes
+            onlineSupportSiteName     = $CurrentState.onlineSupportSiteName
+            onlineSupportSiteUrl      = $CurrentState.onlineSupportSiteUrl
+            privacyUrl                = $CurrentState.privacyUrl
+        }
+        $ExpectedValue = @{
+            displayName               = $Settings.displayName
+            showLogo                  = $Settings.showLogo
+            showDisplayNameNextToLogo = $Settings.showDisplayNameNextToLogo
+            contactITName             = $Settings.contactITName
+            contactITPhoneNumber      = $Settings.contactITPhoneNumber
+            contactITEmailAddress     = $Settings.contactITEmailAddress
+            contactITNotes            = $Settings.contactITNotes
+            onlineSupportSiteName     = $Settings.onlineSupportSiteName
+            onlineSupportSiteUrl      = $Settings.onlineSupportSiteUrl
+            privacyUrl                = $Settings.privacyUrl
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.intuneBrandingProfile' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'intuneBrandingProfile' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1
index 25a4f7168828..24948cf10bf7 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1
@@ -33,7 +33,6 @@ function Invoke-CIPPStandardintuneDeviceReg {
 
     param($Tenant, $Settings)
     $TestResult = Test-CIPPStandardLicense -StandardName 'intuneDeviceReg' -TenantFilter $Tenant -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'intuneDeviceReg'
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -42,15 +41,14 @@ function Invoke-CIPPStandardintuneDeviceReg {
 
     try {
         $PreviousSetting = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy' -tenantid $Tenant
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the intuneDeviceReg state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
     }
     $StateIsCorrect = if ($PreviousSetting.userDeviceQuota -eq $Settings.max) { $true } else { $false }
 
-    If ($Settings.remediate -eq $true) {
+    if ($Settings.remediate -eq $true) {
 
         if ($PreviousSetting.userDeviceQuota -eq $Settings.max) {
             Write-LogMessage -API 'Standards' -tenant $tenant -message "User device quota is already set to $($Settings.max)" -sev Info
@@ -78,8 +76,13 @@ function Invoke-CIPPStandardintuneDeviceReg {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : $PreviousSetting.userDeviceQuota
-        Set-CIPPStandardsCompareField -FieldName 'standards.intuneDeviceReg' -FieldValue $state -TenantFilter $Tenant
+        $CurrentValue = @{
+            userDeviceQuota = $PreviousSetting.userDeviceQuota
+        }
+        $ExpectedValue = @{
+            userDeviceQuota = $Settings.max
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.intuneDeviceReg' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'intuneDeviceReg' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
index 41faf6faf746..b980c034ddd0 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
@@ -33,7 +33,6 @@ function Invoke-CIPPStandardintuneDeviceRetirementDays {
 
     param($Tenant, $Settings)
     $TestResult = Test-CIPPStandardLicense -StandardName 'intuneDeviceRetirementDays' -TenantFilter $Tenant -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'intuneDeviceRetirementDays'
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -42,8 +41,7 @@ function Invoke-CIPPStandardintuneDeviceRetirementDays {
 
     try {
         $CurrentInfo = (New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/deviceManagement/managedDeviceCleanupRules' -tenantid $Tenant)
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the intuneDeviceRetirementDays state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -84,8 +82,13 @@ function Invoke-CIPPStandardintuneDeviceRetirementDays {
     }
 
     if ($Settings.report -eq $true) {
-        $state = $StateIsCorrect ? $true : $CurrentInfo.DeviceInactivityBeforeRetirementInDays
-        Set-CIPPStandardsCompareField -FieldName 'standards.intuneDeviceRetirementDays' -FieldValue $state -Tenant $tenant
+        $CurrentValue = @{
+            deviceInactivityBeforeRetirementInDays = $CurrentInfo.DeviceInactivityBeforeRetirementInDays
+        }
+        $ExpectedValue = @{
+            deviceInactivityBeforeRetirementInDays = $Settings.days
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.intuneDeviceRetirementDays' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         Add-CIPPBPAField -FieldName 'intuneDeviceRetirementDays' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1
index 2ed285caec7f..81fa6fae17c9 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1
@@ -29,7 +29,6 @@ function Invoke-CIPPStandardintuneRequireMFA {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'intuneRequireMFA'
 
     try {
         $PreviousSetting = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy' -tenantid $Tenant
@@ -69,7 +68,14 @@ function Invoke-CIPPStandardintuneRequireMFA {
 
     if ($Settings.report -eq $true) {
         $RequireMFA = if ($PreviousSetting.multiFactorAuthConfiguration -eq 'required') { $true } else { $false }
-        Set-CIPPStandardsCompareField -FieldName 'standards.intuneRequireMFA' -FieldValue $RequireMFA -Tenant $Tenant
+
+        $CurrentValue = @{
+            multiFactorAuthConfiguration = $PreviousSetting.multiFactorAuthConfiguration
+        }
+        $ExpectedValue = @{
+            multiFactorAuthConfiguration = 'required'
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.intuneRequireMFA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'intuneRequireMFA' -FieldValue $RequireMFA -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardlaps.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardlaps.ps1
index 6f1886a9a3fc..b08508db2e6e 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardlaps.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardlaps.ps1
@@ -31,7 +31,6 @@ function Invoke-CIPPStandardlaps {
     #>
 
     param($Tenant, $Settings)
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'laps'
 
     try {
         $PreviousSetting = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy' -tenantid $Tenant
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
index 69e82b3fc8a9..054066c38646 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
@@ -36,7 +36,7 @@ function Invoke-CIPPStandardsharingCapability {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'sharingCapability' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'sharingCapability' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -45,8 +45,7 @@ function Invoke-CIPPStandardsharingCapability {
 
     try {
         $CurrentInfo = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the sharingCapability state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -96,11 +95,12 @@ function Invoke-CIPPStandardsharingCapability {
     }
 
     if ($Settings.report -eq $true) {
-        if ($CurrentInfo.sharingCapability -eq $level) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentInfo | Select-Object -Property sharingCapability
+        $CurrentValue = @{
+            sharingCapability = $CurrentInfo.sharingCapability
+        }
+        $ExpectedValue = @{
+            sharingCapability = $level
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.sharingCapability' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.sharingCapability' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
index 16602aaac0a6..6aae7a5b8dcd 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
@@ -35,7 +35,7 @@ function Invoke-CIPPStandardsharingDomainRestriction {
     #>
 
     param($Tenant, $Settings)
-    $TestResult = Test-CIPPStandardLicense -StandardName 'sharingDomainRestriction' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU','ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
+    $TestResult = Test-CIPPStandardLicense -StandardName 'sharingDomainRestriction' -TenantFilter $Tenant -RequiredCapabilities @('SHAREPOINTWAC', 'SHAREPOINTSTANDARD', 'SHAREPOINTENTERPRISE', 'SHAREPOINTENTERPRISE_EDU', 'ONEDRIVE_BASIC', 'ONEDRIVE_ENTERPRISE')
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -44,8 +44,7 @@ function Invoke-CIPPStandardsharingDomainRestriction {
 
     try {
         $CurrentState = New-GraphGetRequest -Uri 'https://graph.microsoft.com/beta/admin/sharepoint/settings' -tenantid $Tenant -AsApp $true
-    }
-    catch {
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the SharingDomainRestriction state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -114,11 +113,16 @@ function Invoke-CIPPStandardsharingDomainRestriction {
     if ($Settings.report -eq $true) {
         Add-CIPPBPAField -FieldName 'sharingDomainRestriction' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $tenant
 
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState | Select-Object sharingAllowedDomainList, sharingDomainRestrictionMode
+        $CurrentValue = @{
+            sharingDomainRestrictionMode = $CurrentState.sharingDomainRestrictionMode
+            sharingAllowedDomainList     = $CurrentState.sharingAllowedDomainList
+            sharingBlockedDomainList     = $CurrentState.sharingBlockedDomainList
+        }
+        $ExpectedValue = @{
+            sharingDomainRestrictionMode = $mode
+            sharingAllowedDomainList     = if ($mode -eq 'allowList') { $SelectedDomains } else { @() }
+            sharingBlockedDomainList     = if ($mode -eq 'blockList') { $SelectedDomains } else { @() }
         }
-        Set-CIPPStandardsCompareField -FieldName 'standards.sharingDomainRestriction' -FieldValue $FieldValue -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.sharingDomainRestriction' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1 b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1
index d333a06c1adc..18b75b21b643 100644
--- a/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1
+++ b/Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1
@@ -36,7 +36,6 @@ function Invoke-CIPPStandardunmanagedSync {
 
     param($Tenant, $Settings)
     $TestResult = Test-CIPPStandardLicense -StandardName 'unmanagedSync' -TenantFilter $Tenant -RequiredCapabilities @('INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1')
-    ##$Rerun -Type Standard -Tenant $Tenant -Settings $Settings 'unmanagedSync'
 
     if ($TestResult -eq $false) {
         Write-Host "We're exiting as the correct license is not present for this standard."
@@ -45,9 +44,8 @@ function Invoke-CIPPStandardunmanagedSync {
 
     try {
         $CurrentState = Get-CIPPSPOTenant -TenantFilter $Tenant |
-        Select-Object _ObjectIdentity_, TenantFilter, ConditionalAccessPolicy
-    }
-    catch {
+            Select-Object _ObjectIdentity_, TenantFilter, ConditionalAccessPolicy
+    } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the unmanagedSync state for $Tenant. Error: $ErrorMessage" -Sev Error
         return
@@ -83,9 +81,13 @@ function Invoke-CIPPStandardunmanagedSync {
     }
 
     if ($Settings.report -eq $true) {
-
-        $State = $StateIsCorrect ? $true : $CurrentState.ConditionalAccessPolicy
-        Set-CIPPStandardsCompareField -FieldName 'standards.unmanagedSync' -FieldValue $State -Tenant $Tenant
+        $CurrentValue = @{
+            ConditionalAccessPolicy = $CurrentState.ConditionalAccessPolicy
+        }
+        $ExpectedValue = @{
+            ConditionalAccessPolicy = $WantedState
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.unmanagedSync' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
         Add-CIPPBPAField -FieldName 'unmanagedSync' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1 b/Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1
index 5ac9ecb20621..76db653fa17f 100644
--- a/Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1
+++ b/Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1
@@ -30,11 +30,14 @@ function Get-TenantGroups {
     param(
         [string]$GroupId,
         [string]$TenantFilter,
-        [switch]$Dynamic
+        [switch]$Dynamic,
+        [switch]$SkipCache
     )
     $CacheKey = "$GroupId|$TenantFilter|$($Dynamic.IsPresent)"
 
-    if ($script:TenantGroupsResultCache.ContainsKey($CacheKey)) {
+    if ($SkipCache) {
+        Write-Verbose "Skipping cache for: $CacheKey"
+    } elseif ($script:TenantGroupsResultCache.ContainsKey($CacheKey)) {
         Write-Verbose "Returning cached result for: $CacheKey"
         return $script:TenantGroupsResultCache[$CacheKey]
     }
@@ -47,7 +50,7 @@ function Get-TenantGroups {
     }
 
     # Load table data into cache if not already loaded
-    if (-not $script:TenantGroupsCache.Groups -or -not $script:TenantGroupsCache.Members) {
+    if (-not $script:TenantGroupsCache.Groups -or -not $script:TenantGroupsCache.Members -or $SkipCache) {
         Write-Verbose 'Loading TenantGroups and TenantGroupMembers tables into cache'
 
         $GroupTable = Get-CippTable -tablename 'TenantGroups'
diff --git a/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1 b/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1
index 8ea1a508d4c6..9cbc794e05fd 100644
--- a/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1
+++ b/Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1
@@ -53,7 +53,9 @@ function Update-CIPPDynamicTenantGroups {
                 $script:TenantGroupMembersCache[$Member.GroupId] = [system.collections.generic.list[string]]::new()
             }
             $script:TenantGroupMembersCache[$Member.GroupId].Add($Member.customerId)
-        }        foreach ($Group in $DynamicGroups) {
+        }
+
+        foreach ($Group in $DynamicGroups) {
             try {
                 Write-LogMessage -API 'TenantGroups' -message "Processing dynamic group: $($Group.Name)" -sev Info
                 $Rules = @($Group.DynamicRules | ConvertFrom-Json)
@@ -96,12 +98,34 @@ function Update-CIPPDynamicTenantGroups {
                             }
                         }
                         'tenantGroupMember' {
-                            # Get members of the referenced tenant group
-                            $ReferencedGroupId = $Value.value
-                            if ($Operator -eq 'in') {
-                                "`$_.customerId -in `$script:TenantGroupMembersCache['$ReferencedGroupId']"
+                            # Get members of the referenced tenant group(s)
+                            if ($Operator -in @('in', 'notin')) {
+                                # Handle array of group IDs
+                                $ReferencedGroupIds = @($Value.value)
+
+                                # Collect all unique member customerIds from all referenced groups
+                                $AllMembers = [System.Collections.Generic.HashSet[string]]::new()
+                                foreach ($GroupId in $ReferencedGroupIds) {
+                                    if ($script:TenantGroupMembersCache.ContainsKey($GroupId)) {
+                                        foreach ($MemberId in $script:TenantGroupMembersCache[$GroupId]) {
+                                            [void]$AllMembers.Add($MemberId)
+                                        }
+                                    }
+                                }
+
+                                # Convert to array string for condition
+                                $MemberArray = $AllMembers | ForEach-Object { "'$_'" }
+                                $MemberArrayString = $MemberArray -join ', '
+
+                                if ($Operator -eq 'in') {
+                                    "`$_.customerId -in @($MemberArrayString)"
+                                } else {
+                                    "`$_.customerId -notin @($MemberArrayString)"
+                                }
                             } else {
-                                "`$_.customerId -notin `$script:TenantGroupMembersCache['$ReferencedGroupId']"
+                                # Single value with other operators
+                                $ReferencedGroupId = $Value.value
+                                "`$_.customerId -$Operator `$script:TenantGroupMembersCache['$ReferencedGroupId']"
                             }
                         }
                         'customVariable' {
diff --git a/Modules/CIPPCore/Public/Test-CIPPRerun.ps1 b/Modules/CIPPCore/Public/Test-CIPPRerun.ps1
index a329eb0a3d6a..87caf6fc8950 100644
--- a/Modules/CIPPCore/Public/Test-CIPPRerun.ps1
+++ b/Modules/CIPPCore/Public/Test-CIPPRerun.ps1
@@ -7,15 +7,25 @@ function Test-CIPPRerun {
         $Settings,
         $Headers,
         [switch]$Clear,
-        [switch]$ClearAll
+        [switch]$ClearAll,
+        [int64]$Interval = 0,  # Custom interval in seconds (for scheduled tasks)
+        [int64]$BaseTime = 0   # Base time to calculate from (defaults to current time)
     )
     $RerunTable = Get-CIPPTable -tablename 'RerunCache'
-    $EstimatedDifference = switch ($Type) {
-        'Standard' { 9800 } # 2 hours 45 minutes ish.
-        'BPA' { 85000 } # 24 hours ish.
-        default { throw "Unknown type: $Type" }
+
+    # Use custom interval if provided, otherwise use type-based defaults
+    if ($Interval -gt 0) {
+        $EstimatedDifference = $Interval
+    } else {
+        $EstimatedDifference = switch ($Type) {
+            'Standard' { 9800 } # 2 hours 45 minutes ish.
+            'BPA' { 85000 } # 24 hours ish.
+            default { throw "Unknown type: $Type" }
+        }
     }
-    $CurrentUnixTime = [int][double]::Parse((Get-Date -UFormat %s))
+
+    # Use BaseTime if provided, otherwise use current time
+    $CurrentUnixTime = if ($BaseTime -gt 0) { $BaseTime } else { [int][double]::Parse((Get-Date -UFormat %s)) }
     $EstimatedNextRun = $CurrentUnixTime + $EstimatedDifference
 
     try {
diff --git a/Modules/CIPPCore/Public/Tests/CISA-Missing-Caches.md b/Modules/CIPPCore/Public/Tests/CISA-Missing-Caches.md
new file mode 100644
index 000000000000..5b7bd652195a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA-Missing-Caches.md
@@ -0,0 +1,195 @@
+# Missing CIPP Caches for CISA Tests
+
+This document lists the caches that need to be created to support the remaining CISA tests that cannot currently be implemented.
+
+## ✅ Implemented Cache Functions
+
+### 1. ✅ CASMailbox Cache
+**Required For:**
+- ✅ MS.EXO.5.1 - SMTP Authentication
+
+**Status**: ✅ IMPLEMENTED in Set-CIPPDBCacheCASMailbox.ps1
+
+---
+
+### 2. ✅ ExoSharingPolicy Cache
+**Required For:**
+- ✅ MS.EXO.6.1 - Contact Sharing
+- ✅ MS.EXO.6.2 - Calendar Sharing
+
+**Status**: ✅ IMPLEMENTED in Set-CIPPDBCacheExoSharingPolicy.ps1
+
+---
+
+### 3. ✅ ExoAdminAuditLogConfig Cache
+**Required For:**
+- ✅ MS.EXO.17.1 - Audit Log
+- ✅ MS.EXO.17.3 - Audit Log Retention
+
+**Status**: ✅ IMPLEMENTED in Set-CIPPDBCacheExoAdminAuditLogConfig.ps1
+
+---
+
+### 4. ✅ ExoPresetSecurityPolicy Cache
+**Required For:**
+- ✅ MS.EXO.11.1 - Impersonation
+- ✅ MS.EXO.11.2 - Impersonation Tips
+- ✅ MS.EXO.11.3 - Mailbox Intelligence
+
+**Status**: ✅ IMPLEMENTED in Set-CIPPDBCacheExoPresetSecurityPolicy.ps1
+
+---
+
+### 5. ✅ ExoTenantAllowBlockList Cache
+**Required For:**
+- ✅ MS.EXO.12.1 - Anti-Spam Allow List
+
+**Status**: ✅ IMPLEMENTED in Set-CIPPDBCacheExoTenantAllowBlockList.ps1
+
+---
+
+## Required New Cache Functions
+**Required For:**
+- MS.EXO.8.1 - DLP Solution
+- MS.EXO.8.2 - DLP PII
+- MS.EXO.8.4 - DLP Baseline Rules
+
+**SecurityCompliance Command:**
+```powershell
+Get-DlpCompliancePolicy | Select-Object Name, Enabled, Mode
+Get-DlpComplianceRule | Select-Object Name, ParentPolicyName, ContentContainsSensitiveInformation, Disabled
+```
+1
+**Cache Function Names:**
+- `Set-CIPPDBCacheSccDlpPolicy`
+- `Set-CIPPDBCacheSccDlpRule`
+
+**Properties Needed:**
+- Policy: Name, Enabled, Mode
+- Rule: Name, ParentPolicyName, ContentContainsSensitiveInformation, Disabled
+
+**Note:** Requires SecurityCompliance PowerShell connection
+
+---
+
+### 2. SecurityCompliance ProtectionAlert Cache
+**Required For:**
+- MS.EXO.16.1 - Alerts
+
+**SecurityCompliance Command:**
+```powershell
+Get-ProtectionAlert | Select-Object Name, Disabled
+```
+
+**Cache Function Name:** `Set-CIPPDBCacheSccProtectionAlert`
+
+**Properties Needed:**
+- Name
+- Disabled
+
+**Note:** Requires SecurityCompliance PowerShell connection
+
+---
+
+### 3. SecurityCompliance ActivityAlert Cache
+**Required For:**
+- MS.EXO.16.2 - Alert SIEM
+
+**SecurityCompliance Command:**
+```powershell
+Get-ActivityAlert | Select-Object Name, Disabled, NotificationEnabled, Type
+```
+
+**Cache Function Name:** `Set-CIPPDBCacheSccActivityAlert`
+
+**Properties Needed:**
+- Name
+- Disabled
+- NotificationEnabled
+- Type
+
+**Note:** Requires SecurityCompliance PowerShell connection
+
+---
+
+## DNS-Based Tests (Cannot Be Cached)
+
+These tests require external DNS lookups and cannot be implemented with cached Exchange data:
+
+### MS.EXO.2.1 - SPF Restriction
+**Requires:** DNS TXT record lookup for SPF
+**Query:** `nslookup -type=txt <domain>`
+
+### MS.EXO.2.2 - SPF Directive
+**Requires:** DNS TXT record parsing for SPF policy
+**Query:** Parse SPF record for `~all` or `-all`
+
+### MS.EXO.4.1 - DMARC Record Exists
+**Requires:** DNS TXT record lookup for DMARC
+**Query:** `nslookup -type=txt _dmarc.<domain>`
+
+### MS.EXO.4.2 - DMARC Reject Policy
+**Requires:** DNS TXT record parsing for DMARC policy
+**Query:** Parse DMARC record for `p=reject` or `p=quarantine`
+
+### MS.EXO.4.3 - DMARC Aggregate Reports
+**Requires:** DNS TXT record parsing for DMARC rua tags
+**Query:** Parse DMARC record for `rua=` email addresses
+
+### MS.EXO.4.4 - DMARC Reports
+**Requires:** DNS TXT record parsing for DMARC report configuration
+**Query:** Parse DMARC record for report targets
+
+### MS.EXO.7.1 - External Sender Warning
+**Requires:** ExoOrganizationConfig.ExternalInOutlook property
+**Note:** May already be in ExoOrganizationConfig cache - needs verification
+
+### MS.EXO.13.1 - Mailbox Auditing
+**Requires:** ExoOrganizationConfig.AuditDisabled property
+**Note:** May already be in ExoOrganizationConfig cache - needs verification
+
+## Manual Assessment Tests (Cannot Be Automated)
+
+### MS.EXO.8.3 - DLP Alternate Solution
+**Reason:** Requires manual assessment of 3rd party DLP solutions
+
+### MS.EXO.9.4 - Email Filter Alternative
+**Reason:** Requires manual assessment of 3rd party email filtering solutions
+
+### MS.EXO.14.4 - Spam Alternative Solution
+**Reason:** Requires manual assessment of 3rd party anti-spam solutions
+
+### MS.EXO.17.2 - Audit Log Premium
+**Reason:** Requires license validation and advanced audit policy checks beyond cached data
+
+---
+
+## Implementation Priority
+
+### High Priority (Core Security Controls):
+1. CASMailbox - SMTP Auth control
+2. ExoAdminAuditLogConfig - Audit logging
+3. ExoTenantAllowBlockList - Allow list bypass prevention
+
+### Medium Priority (DLP and Alerts):
+4. SecurityCompliance DLP caches - Data loss prevention
+5. SecurityCompliance Alert caches - Security monitoring
+
+### Low Priority (Advanced Features):
+6. ExoSharingPolicy - External sharing controls
+7. ExoPresetSecurityPolicy - Preset security policies
+
+---
+
+## Notes on Implementation
+
+1. **Graph API Alternative**: Some Exchange Online cmdlets may have equivalent Graph API endpoints that could be used instead.
+
+## Summary
+
+- **New Caches Required**: 8 cache functions
+- **DNS Tests**: 6 tests (architectural limitation)
+- **Manual Tests**: 4 tests (cannot be automated)
+- **Implementable After New Caches**: 15 additional tests
+- **Current Implementation**: 13 tests
+- **Total Possible with New Caches**: 28 tests (68% coverage)
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO101.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO101.md
new file mode 100644
index 000000000000..47d0249a0689
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO101.md
@@ -0,0 +1,21 @@
+Emails SHALL be filtered by attachment file types.
+
+Email attachment filtering helps prevent malicious files from reaching users' inboxes. By blocking or quarantining emails with potentially dangerous file types, organizations can significantly reduce the risk of malware infections and data breaches.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-malware
+2. Select each malware filter policy
+3. Under "Protection settings":
+   - Enable "Enable the common attachments filter"
+4. Or use PowerShell:
+```powershell
+Set-MalwareFilterPolicy -Identity "Default" -EnableFileFilter $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.10.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo101v1)
+- [Configure anti-malware policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-protection-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO101.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO101.ps1
new file mode 100644
index 000000000000..cda775b98b25
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO101.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO101 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.10.1 - Emails SHALL be filtered by attachment file types
+
+    .DESCRIPTION
+    Checks if malware filter policies have file filtering enabled
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $MalwarePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicy'
+
+        if (-not $MalwarePolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoMalwareFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Emails SHALL be filtered by attachment file types' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO101' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = $MalwarePolicies | Where-Object { -not $_.EnableFileFilter }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($MalwarePolicies.Count) malware filter policy/policies have file filtering enabled."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($MalwarePolicies.Count) malware filter policy/policies do not have file filtering enabled:`n`n"
+            $Result += "| Policy Name | File Filter Enabled |`n"
+            $Result += "| :---------- | :------------------ |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Name) | $($Policy.EnableFileFilter) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO101' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Emails SHALL be filtered by attachment file types' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Emails SHALL be filtered by attachment file types' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO101' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO102.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO102.md
new file mode 100644
index 000000000000..438d6636be83
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO102.md
@@ -0,0 +1,23 @@
+Emails identified as containing malware SHALL be quarantined or dropped.
+
+Ensuring that emails containing malware are immediately quarantined or deleted prevents malicious content from reaching users' mailboxes. This is a critical security control that stops malware distribution at the email gateway level.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-malware
+2. Select each malware filter policy
+3. Under "Protection settings":
+   - Set "Malware detection response" to either "Delete entire message" or "Quarantine message"
+4. Or use PowerShell:
+```powershell
+Set-MalwareFilterPolicy -Identity "Default" -Action Quarantine
+# Or
+Set-MalwareFilterPolicy -Identity "Default" -Action DeleteMessage
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.10.2](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo102v1)
+- [Configure anti-malware policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-protection-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO102.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO102.ps1
new file mode 100644
index 000000000000..5ced966d198e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO102.ps1
@@ -0,0 +1,58 @@
+function Invoke-CippTestCISAMSEXO102 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.10.2 - Emails identified as malware SHALL be quarantined or dropped
+
+    .DESCRIPTION
+    Checks if malware filter policies quarantine or delete emails with malware
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $MalwarePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicy'
+
+        if (-not $MalwarePolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoMalwareFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Emails identified as malware SHALL be quarantined or dropped' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO102' -TenantFilter $Tenant
+            return
+        }
+
+        $AcceptableActions = @('DeleteMessage', 'Quarantine')
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $MalwarePolicies) {
+            if ($Policy.Action -notin $AcceptableActions) {
+                $FailedPolicies.Add([PSCustomObject]@{
+                    'Policy Name' = $Policy.Name
+                    'Current Action' = $Policy.Action
+                    'Expected' = 'DeleteMessage or Quarantine'
+                })
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($MalwarePolicies.Count) malware filter policy/policies quarantine or delete emails with malware."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($MalwarePolicies.Count) malware filter policy/policies do not quarantine or delete malware:`n`n"
+            $Result += "| Policy Name | Current Action | Expected |`n"
+            $Result += "| :---------- | :------------- | :------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.'Policy Name') | $($Policy.'Current Action') | $($Policy.Expected) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO102' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Emails identified as malware SHALL be quarantined or dropped' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Emails identified as malware SHALL be quarantined or dropped' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO102' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO103.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO103.md
new file mode 100644
index 000000000000..17f11b64670f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO103.md
@@ -0,0 +1,21 @@
+Email scanning SHALL be capable of reviewing emails after delivery.
+
+Zero-hour Auto Purge (ZAP) provides post-delivery protection by retroactively detecting and removing malicious emails that were initially deemed safe. This is crucial because malware signatures and threat intelligence are constantly updated, and emails that were safe at delivery time may later be identified as malicious.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-malware
+2. Select each malware filter policy
+3. Under "Protection settings":
+   - Enable "Enable zero-hour auto purge (ZAP) for malware"
+4. Or use PowerShell:
+```powershell
+Set-MalwareFilterPolicy -Identity "Default" -ZapEnabled $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.10.3](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo103v1)
+- [Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO103.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO103.ps1
new file mode 100644
index 000000000000..41f1e92f6385
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO103.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO103 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.10.3 - Email scanning SHALL be capable of reviewing emails after delivery (ZAP)
+
+    .DESCRIPTION
+    Checks if Zero-hour Auto Purge (ZAP) is enabled for malware protection
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $MalwarePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicy'
+
+        if (-not $MalwarePolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoMalwareFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Email scanning SHALL be capable of reviewing emails after delivery' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO103' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = $MalwarePolicies | Where-Object { -not $_.ZapEnabled }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($MalwarePolicies.Count) malware filter policy/policies have ZAP (Zero-hour Auto Purge) enabled."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($MalwarePolicies.Count) malware filter policy/policies do not have ZAP enabled:`n`n"
+            $Result += "| Policy Name | ZAP Enabled |`n"
+            $Result += "| :---------- | :---------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Name) | $($Policy.ZapEnabled) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO103' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Email scanning SHALL be capable of reviewing emails after delivery' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Email scanning SHALL be capable of reviewing emails after delivery' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO103' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO11.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO11.md
new file mode 100644
index 000000000000..be33a98245e3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO11.md
@@ -0,0 +1,22 @@
+Automatic forwarding to external domains SHALL be disabled.
+
+Disabling automatic forwarding prevents potential data exfiltration scenarios where malicious actors could set up forwarding rules to steal sensitive information. This control ensures that emails cannot be automatically forwarded outside the organization without proper oversight.
+
+**Remediation Action:**
+
+1. Navigate to Exchange Admin Center > Mail flow > Remote domains
+2. For each remote domain, disable automatic forwarding:
+   - Select the domain
+   - Click Edit
+   - Set "Allow automatic forwarding" to Off
+3. Or use PowerShell:
+```powershell
+Get-RemoteDomain | Set-RemoteDomain -AutoForwardEnabled $false
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.1.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo11v1)
+- [Configure remote domain settings](https://learn.microsoft.com/exchange/mail-flow-best-practices/remote-domains/remote-domains)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO11.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO11.ps1
new file mode 100644
index 000000000000..96651f05b743
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO11.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO11 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.1.1 - Automatic forwarding to external domains SHALL be disabled
+
+    .DESCRIPTION
+    Checks if automatic forwarding to external domains is disabled across all remote domains
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $RemoteDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoRemoteDomain'
+
+        if (-not $RemoteDomains) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoRemoteDomain cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Automatic forwarding to external domains SHALL be disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO11' -TestType 'Identity' -TenantFilter $Tenant
+            return
+        }
+
+        $ForwardingEnabledDomains = $RemoteDomains | Where-Object { $_.AutoForwardEnabled -eq $true }
+
+        if (($ForwardingEnabledDomains | Measure-Object).Count -eq 0) {
+            $Result = '✅ **Pass**: Automatic forwarding to external domains is disabled for all remote domains.'
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($ForwardingEnabledDomains.Count) domain(s) have automatic forwarding enabled:`n`n"
+            $Result += "| Domain Name | Auto Forward |`n"
+            $Result += "| :---------- | :----------- |`n"
+            foreach ($Domain in $ForwardingEnabledDomains) {
+                $Result += "| $($Domain.DomainName) | $($Domain.AutoForwardEnabled) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO11' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Automatic forwarding to external domains SHALL be disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Automatic forwarding to external domains SHALL be disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO11' -TestType 'Identity' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.md
new file mode 100644
index 000000000000..c4979f85630e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.md
@@ -0,0 +1,22 @@
+Impersonation protection checks SHOULD be used.
+
+Impersonation protection defends against phishing attacks where attackers impersonate trusted users or domains. These checks analyze sender patterns, domain similarities, and user behavior to identify and block sophisticated impersonation attempts before they reach users.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Preset security policies
+2. Enable either Standard or Strict preset security policy
+3. Ensure policies include appropriate user and domain protection
+4. Or use PowerShell:
+```powershell
+# Enable standard preset security policy
+Enable-EOPProtectionPolicyRule -Identity "Standard Preset Security Policy"
+Enable-ATPProtectionPolicyRule -Identity "Standard Preset Security Policy"
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.11.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo111v1)
+- [Preset security policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/preset-security-policies)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.ps1
new file mode 100644
index 000000000000..4bfd427b47d4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestCISAMSEXO111 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.11.1 - Impersonation protection checks SHOULD be used
+
+    .DESCRIPTION
+    Checks if both standard and strict EOP/ATP preset security policies are enabled
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $PresetPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoPresetSecurityPolicy'
+
+        if (-not $PresetPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoPresetSecurityPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Impersonation protection checks SHOULD be used' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Protection' -TestId 'CISAMSEXO111' -TenantFilter $Tenant
+            return
+        }
+
+        $StandardEOP = $PresetPolicies | Where-Object { $_.Identity -eq 'Standard Preset Security Policy' -and $_.State -eq 'Enabled' }
+        $StrictEOP = $PresetPolicies | Where-Object { $_.Identity -eq 'Strict Preset Security Policy' -and $_.State -eq 'Enabled' }
+
+        $StandardATP = $PresetPolicies | Where-Object { $_.Identity -like '*Preset Security Policy*' -and $_.ImpersonationProtectionState -eq 'Enabled' }
+
+        $EnabledPolicies = @()
+        if ($StandardEOP) { $EnabledPolicies += 'Standard EOP' }
+        if ($StrictEOP) { $EnabledPolicies += 'Strict EOP' }
+        if ($StandardATP) { $EnabledPolicies += "$($StandardATP.Count) ATP policy/policies with impersonation protection" }
+
+        if ($EnabledPolicies.Count -gt 0) {
+            $Result = "✅ **Pass**: Preset security policies with impersonation protection are enabled:`n`n"
+            $Result += ($EnabledPolicies | ForEach-Object { "- $_" }) -join "`n"
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: No preset security policies with impersonation protection enabled.`n`n"
+            $Result += "Enable Standard or Strict preset security policies to provide impersonation protection."
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO111' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Impersonation protection checks SHOULD be used' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Impersonation protection checks SHOULD be used' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Protection' -TestId 'CISAMSEXO111' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO112.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO112.md
new file mode 100644
index 000000000000..6ef65e55b934
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO112.md
@@ -0,0 +1,26 @@
+User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed.
+
+Safety tips provide visual warnings to users when emails contain indicators of impersonation attempts, such as similar display names, lookalike domains, or unusual character patterns. These warnings help users recognize and avoid phishing attacks.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-phishing
+2. Edit preset security policies or custom anti-phishing policies
+3. Under Impersonation section, enable:
+   - Show user impersonation safety tip
+   - Show domain impersonation safety tip
+   - Show unusual characters impersonation safety tip
+4. Or use PowerShell:
+```powershell
+Set-AntiPhishPolicy -Identity "Standard Preset Security Policy" `
+    -EnableSimilarUsersSafetyTips $true `
+    -EnableSimilarDomainsSafetyTips $true `
+    -EnableUnusualCharactersSafetyTips $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.11.2](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo112v1)
+- [Safety tips in email messages](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection-about#safety-tips-in-email-messages)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO112.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO112.ps1
new file mode 100644
index 000000000000..94d3c617cad5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO112.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestCISAMSEXO112 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.11.2 - User warnings, comparable to the user safety tips included with EOP, SHOULD be displayed
+
+    .DESCRIPTION
+    Checks if impersonation safety tips are enabled in preset security policies
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $PresetPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoPresetSecurityPolicy'
+
+        if (-not $PresetPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoPresetSecurityPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'User warnings comparable to EOP safety tips SHOULD be displayed' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Protection' -TestId 'CISAMSEXO112' -TenantFilter $Tenant
+            return
+        }
+
+        $PoliciesWithTips = $PresetPolicies | Where-Object {
+            ($_.EnableSimilarUsersSafetyTips -eq $true) -or
+            ($_.EnableSimilarDomainsSafetyTips -eq $true) -or
+            ($_.EnableUnusualCharactersSafetyTips -eq $true)
+        }
+
+        if ($PoliciesWithTips.Count -gt 0) {
+            $Result = "✅ **Pass**: $($PoliciesWithTips.Count) policy/policies have impersonation safety tips enabled:`n`n"
+            $Result += "| Policy | Similar Users Tips | Similar Domains Tips | Unusual Characters Tips |`n"
+            $Result += "| :----- | :----------------- | :------------------- | :---------------------- |`n"
+            foreach ($Policy in $PoliciesWithTips) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableSimilarUsersSafetyTips) | $($Policy.EnableSimilarDomainsSafetyTips) | $($Policy.EnableUnusualCharactersSafetyTips) |`n"
+            }
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: No policies found with impersonation safety tips enabled.`n`n"
+            $Result += "Enable safety tips in preset security policies to warn users about potential impersonation."
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO112' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'User warnings comparable to EOP safety tips SHOULD be displayed' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'User warnings comparable to EOP safety tips SHOULD be displayed' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Protection' -TestId 'CISAMSEXO112' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO113.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO113.md
new file mode 100644
index 000000000000..0a5894c4c237
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO113.md
@@ -0,0 +1,24 @@
+Mailbox intelligence SHALL be enabled.
+
+Mailbox intelligence uses machine learning to analyze user email patterns and relationships, identifying anomalous sender behavior that may indicate impersonation attempts. This AI-powered protection adapts to each user's communication patterns for more accurate threat detection.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-phishing
+2. Edit preset security policies or custom anti-phishing policies
+3. Under Impersonation section, enable:
+   - Enable mailbox intelligence
+   - Enable intelligence for impersonation protection
+4. Or use PowerShell:
+```powershell
+Set-AntiPhishPolicy -Identity "Standard Preset Security Policy" `
+    -EnableMailboxIntelligence $true `
+    -EnableMailboxIntelligenceProtection $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.11.3](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo113v1)
+- [Mailbox intelligence in anti-phishing policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO113.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO113.ps1
new file mode 100644
index 000000000000..97541e383c37
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO113.ps1
@@ -0,0 +1,51 @@
+function Invoke-CippTestCISAMSEXO113 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.11.3 - Mailbox intelligence SHALL be enabled
+
+    .DESCRIPTION
+    Checks if mailbox intelligence and impersonation protection are enabled in preset security policies
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $PresetPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoPresetSecurityPolicy'
+
+        if (-not $PresetPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoPresetSecurityPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Mailbox intelligence SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO113' -TenantFilter $Tenant
+            return
+        }
+
+        $PoliciesWithIntelligence = $PresetPolicies | Where-Object {
+            ($_.EnableMailboxIntelligence -eq $true) -and
+            ($_.EnableMailboxIntelligenceProtection -eq $true)
+        }
+
+        if ($PoliciesWithIntelligence.Count -gt 0) {
+            $Result = "✅ **Pass**: $($PoliciesWithIntelligence.Count) policy/policies have mailbox intelligence enabled:`n`n"
+            $Result += "| Policy | Mailbox Intelligence | Intelligence Protection | State |`n"
+            $Result += "| :----- | :------------------- | :---------------------- | :---- |`n"
+            foreach ($Policy in $PoliciesWithIntelligence) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableMailboxIntelligence) | $($Policy.EnableMailboxIntelligenceProtection) | $($Policy.State) |`n"
+            }
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: No policies found with mailbox intelligence enabled.`n`n"
+            $Result += 'Enable mailbox intelligence in preset security policies for AI-powered impersonation protection.'
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO113' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Mailbox intelligence SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Mailbox intelligence SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO113' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO121.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO121.md
new file mode 100644
index 000000000000..4af85199efc5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO121.md
@@ -0,0 +1,23 @@
+Allowed sender lists SHOULD NOT be used.
+
+Adding senders to the tenant allow list bypasses all spam, phishing, and spoofing protection. Compromised or spoofed allowed senders can be used to deliver malicious content directly to users' inboxes without any filtering.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Policies & rules > Threat policies > Tenant Allow/Block Lists
+2. Review and remove entries from the "Allow" list under "Senders"
+3. Or use PowerShell:
+```powershell
+# List all allowed senders
+Get-TenantAllowBlockListItems -ListType Sender -Action Allow
+
+# Remove specific allowed sender
+Remove-TenantAllowBlockListItems -ListType Sender -Ids <submission-id>
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.12.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo121v1)
+- [Manage the Tenant Allow/Block List](https://learn.microsoft.com/microsoft-365/security/office-365-security/tenant-allow-block-list-about)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO121.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO121.ps1
new file mode 100644
index 000000000000..f9bb69153fa4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO121.ps1
@@ -0,0 +1,51 @@
+function Invoke-CippTestCISAMSEXO121 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.12.1 - Allowed senders list SHOULD NOT be used
+
+    .DESCRIPTION
+    Checks if tenant allow/block list has allowed senders configured
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $AllowBlockList = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoTenantAllowBlockList'
+
+        if ($null -eq $AllowBlockList) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoTenantAllowBlockList cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'Allowed sender lists SHOULD NOT be used' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO121' -TenantFilter $Tenant
+            return
+        }
+
+        $AllowedSenders = $AllowBlockList | Where-Object { $_.Action -eq 'Allow' -and $_.ListType -eq 'Sender' }
+
+        if ($AllowedSenders.Count -eq 0) {
+            $Result = '✅ **Pass**: No allowed senders configured in tenant allow/block list.'
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($AllowedSenders.Count) allowed sender(s) configured in tenant allow/block list"
+            if ($AllowedSenders.Count -gt 10) {
+                $Result += ' (showing first 10)'
+            }
+            $Result += ":`n`n"
+            $Result += "| Value | Action | List Type |`n"
+            $Result += "| :---- | :----- | :-------- |`n"
+            foreach ($Sender in ($AllowedSenders | Select-Object -First 10)) {
+                $Result += "| $($Sender.Value) | $($Sender.Action) | $($Sender.ListType) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO121' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Allowed sender lists SHOULD NOT be used' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Allowed sender lists SHOULD NOT be used' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO121' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO122.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO122.md
new file mode 100644
index 000000000000..32352dc39224
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO122.md
@@ -0,0 +1,22 @@
+Safe lists SHOULD NOT be enabled.
+
+Safe lists in Outlook bypass Exchange Online Protection (EOP) spam filtering, which can allow malicious emails from compromised accounts or domains on users' safe senders lists to reach their inboxes. This creates a security risk that attackers can exploit through social engineering.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-spam
+2. Select each anti-spam policy
+3. Under "Actions":
+   - Disable "Enable end-user spam notifications"
+   - Or ensure "On" for safe lists is disabled
+4. Or use PowerShell:
+```powershell
+Set-HostedContentFilterPolicy -Identity "Default" -EnableSafeList $false
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.12.2](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo122v1)
+- [Configure anti-spam policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO122.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO122.ps1
new file mode 100644
index 000000000000..bd50e4688c76
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO122.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO122 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.12.2 - Safe lists SHOULD NOT be enabled
+
+    .DESCRIPTION
+    Checks if anti-spam policies have safe lists disabled
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SpamPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $SpamPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoHostedContentFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'Safe lists SHOULD NOT be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO122' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = $SpamPolicies | Where-Object { $_.EnableSafeList -eq $true }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($SpamPolicies.Count) anti-spam policy/policies have safe lists disabled."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SpamPolicies.Count) anti-spam policy/policies have safe lists enabled:`n`n"
+            $Result += "| Policy Name | Safe List Enabled |`n"
+            $Result += "| :---------- | :---------------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Name) | $($Policy.EnableSafeList) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO122' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Safe lists SHOULD NOT be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Safe lists SHOULD NOT be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO122' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO131.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO131.md
new file mode 100644
index 000000000000..26ea16f7bbb2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO131.md
@@ -0,0 +1,19 @@
+Mailbox auditing SHALL be enabled.
+
+Mailbox auditing logs user and administrator actions in mailboxes, providing critical forensic data for security investigations and compliance requirements. This enables detection of unauthorized access and data exfiltration attempts.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft Purview compliance portal > Audit
+2. Ensure mailbox auditing is turned on
+3. Or use PowerShell:
+```powershell
+Set-OrganizationConfig -AuditDisabled $false
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.13.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo131v1)
+- [Manage mailbox auditing](https://learn.microsoft.com/purview/audit-mailboxes)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO131.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO131.ps1
new file mode 100644
index 000000000000..e3513310346d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO131.ps1
@@ -0,0 +1,44 @@
+function Invoke-CippTestCISAMSEXO131 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.13.1 - Mailbox auditing SHALL be enabled
+
+    .DESCRIPTION
+    Checks if mailbox auditing is enabled in Exchange Online organization config
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $OrgConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoOrganizationConfig'
+
+        if (-not $OrgConfig) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoOrganizationConfig cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Mailbox auditing SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance' -TestId 'CISAMSEXO131' -TenantFilter $Tenant
+            return
+        }
+
+        $OrgConfigObject = $OrgConfig | Select-Object -First 1
+
+        if ($OrgConfigObject.AuditDisabled -eq $false) {
+            $Result = '✅ **Pass**: Mailbox auditing is enabled for the organization.'
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: Mailbox auditing is disabled for the organization.`n`n"
+            $Result += "**Current Setting:**`n"
+            $Result += "- AuditDisabled: $($OrgConfigObject.AuditDisabled)"
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO131' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Mailbox auditing SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Mailbox auditing SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance' -TestId 'CISAMSEXO131' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.md
new file mode 100644
index 000000000000..8b7ff1d73025
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.md
@@ -0,0 +1,21 @@
+High confidence spam SHALL be quarantined.
+
+High confidence spam represents emails that Microsoft's filtering systems are very confident are spam. Quarantining these messages rather than delivering them to junk mail folders provides better protection and allows administrators to review and release legitimate emails if needed.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-spam
+2. Select each anti-spam policy
+3. Under "Actions":
+   - Set "High confidence spam" action to "Quarantine message"
+4. Or use PowerShell:
+```powershell
+Set-HostedContentFilterPolicy -Identity "Default" -HighConfidenceSpamAction Quarantine
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.14.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo141v2)
+- [Configure anti-spam policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.ps1
new file mode 100644
index 000000000000..9e332811ea10
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO141.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO141 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.14.1 - High confidence spam SHALL be quarantined
+
+    .DESCRIPTION
+    Checks if high confidence spam action is set to Quarantine in anti-spam policies
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SpamPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $SpamPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoHostedContentFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'High confidence spam SHALL be quarantined' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO141' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = $SpamPolicies | Where-Object { $_.HighConfidenceSpamAction -ne 'Quarantine' }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($SpamPolicies.Count) anti-spam policy/policies quarantine high confidence spam."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SpamPolicies.Count) anti-spam policy/policies do not quarantine high confidence spam:`n`n"
+            $Result += "| Policy Name | Current Action | Expected |`n"
+            $Result += "| :---------- | :------------- | :------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.'Policy Name') | $($Policy.'Current Action') | $($Policy.Expected) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO141' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'High confidence spam SHALL be quarantined' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'High confidence spam SHALL be quarantined' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO141' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO142.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO142.md
new file mode 100644
index 000000000000..ec3b2ce5e871
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO142.md
@@ -0,0 +1,23 @@
+Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.
+
+Properly handling spam emails prevents users from being exposed to potentially malicious content while still allowing recovery of false positives. Moving spam to junk folders or quarantine provides a balance between security and usability.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-spam
+2. Select each anti-spam policy
+3. Under "Actions":
+   - Set "Spam" action to "Move message to Junk Email folder" or "Quarantine message"
+4. Or use PowerShell:
+```powershell
+Set-HostedContentFilterPolicy -Identity "Default" -SpamAction MoveToJmf
+# Or
+Set-HostedContentFilterPolicy -Identity "Default" -SpamAction Quarantine
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.14.2](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo142v1)
+- [Configure anti-spam policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO142.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO142.ps1
new file mode 100644
index 000000000000..d9d2f8a2ca4e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO142.ps1
@@ -0,0 +1,58 @@
+function Invoke-CippTestCISAMSEXO142 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.14.2 - Spam SHALL be moved to junk email or quarantine
+
+    .DESCRIPTION
+    Checks if spam action is set to MoveToJmf or Quarantine in anti-spam policies
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SpamPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $SpamPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoHostedContentFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'Spam SHALL be moved to junk email or quarantine' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO142' -TenantFilter $Tenant
+            return
+        }
+
+        $AcceptableActions = @('MoveToJmf', 'Quarantine')
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $SpamPolicies) {
+            if ($Policy.SpamAction -notin $AcceptableActions) {
+                $FailedPolicies.Add([PSCustomObject]@{
+                        'Policy Name'    = $Policy.Name
+                        'Current Action' = $Policy.SpamAction
+                        'Expected'       = 'MoveToJmf or Quarantine'
+                    })
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($SpamPolicies.Count) anti-spam policy/policies move spam to junk folder or quarantine."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SpamPolicies.Count) anti-spam policy/policies do not properly handle spam:`n`n"
+            $Result += "| Policy Name | Current Action | Expected |`n"
+            $Result += "| :---------- | :------------- | :------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.'Policy Name') | $($Policy.'Current Action') | $($Policy.Expected) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO142' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Spam SHALL be moved to junk email or quarantine' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Spam SHALL be moved to junk email or quarantine' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO142' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO143.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO143.md
new file mode 100644
index 000000000000..4958c0a1627e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO143.md
@@ -0,0 +1,22 @@
+Allowed senders and domains SHOULD NOT be added to the anti-spam filter.
+
+Adding senders or domains to the allowed list bypasses spam filtering, which can be exploited by attackers. Compromised accounts or spoofed emails from allowed domains will bypass security controls and reach users' inboxes unchecked.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-spam
+2. Select each anti-spam policy
+3. Under "Allowed and blocked senders and domains":
+   - Review and remove entries from "Allowed senders" list
+   - Review and remove entries from "Allowed domains" list
+4. Or use PowerShell:
+```powershell
+Set-HostedContentFilterPolicy -Identity "Default" -AllowedSenders @() -AllowedSenderDomains @()
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.14.3](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo143v1)
+- [Configure allowed and blocked senders](https://learn.microsoft.com/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO143.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO143.ps1
new file mode 100644
index 000000000000..a5882bb96120
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO143.ps1
@@ -0,0 +1,61 @@
+function Invoke-CippTestCISAMSEXO143 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.14.3 - Spam filter bypass SHALL be disabled
+
+    .DESCRIPTION
+    Checks if anti-spam policies have empty allowed senders and domains lists
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SpamPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $SpamPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoHostedContentFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Allowed senders SHOULD NOT be added to anti-spam filter' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO143' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $SpamPolicies) {
+            $AllowedSenders = if ($Policy.AllowedSenders) { $Policy.AllowedSenders.Count } else { 0 }
+            $AllowedSenderDomains = if ($Policy.AllowedSenderDomains) { $Policy.AllowedSenderDomains.Count } else { 0 }
+
+            if ($AllowedSenders -gt 0 -or $AllowedSenderDomains -gt 0) {
+                $FailedPolicies.Add([PSCustomObject]@{
+                        'Policy Name'     = $Policy.Name
+                        'Allowed Senders' = $AllowedSenders
+                        'Allowed Domains' = $AllowedSenderDomains
+                        'Issue'           = 'Has allowed senders/domains that bypass spam filtering'
+                    })
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($SpamPolicies.Count) anti-spam policy/policies have no spam filter bypasses configured."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SpamPolicies.Count) anti-spam policy/policies have spam filter bypasses configured:`n`n"
+            $Result += "| Policy Name | Allowed Senders | Allowed Domains | Issue |`n"
+            $Result += "| :---------- | :-------------- | :-------------- | :---- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.'Policy Name') | $($Policy.'Allowed Senders') | $($Policy.'Allowed Domains') | $($Policy.Issue) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO143' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Allowed senders SHOULD NOT be added to anti-spam filter' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Allowed senders SHOULD NOT be added to anti-spam filter' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO143' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO151.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO151.md
new file mode 100644
index 000000000000..5fbbde6b6bca
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO151.md
@@ -0,0 +1,21 @@
+URL comparison with a block-list SHOULD be enabled.
+
+Safe Links provides time-of-click verification of URLs in email messages and Office documents. This protection helps prevent users from clicking on malicious links by checking URLs against a dynamically updated block-list of known malicious websites.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Safe Links
+2. Select each Safe Links policy
+3. Under "URL & click protection settings":
+   - Enable "On: Safe Links checks a list of known, malicious links when users click links in email"
+4. Or use PowerShell:
+```powershell
+Set-SafeLinksPolicy -Identity "Default" -EnableSafeLinksForEmail $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.15.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo151v1)
+- [Set up Safe Links policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO151.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO151.ps1
new file mode 100644
index 000000000000..1b63ba30f031
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO151.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO151 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.15.1 - URL comparison with a block-list SHOULD be enabled
+
+    .DESCRIPTION
+    Checks if Safe Links policies have URL scanning enabled
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SafeLinksPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicy'
+
+        if (-not $SafeLinksPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoSafeLinksPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'URL comparison with block-list SHOULD be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO151' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = $SafeLinksPolicies | Where-Object { -not $_.EnableSafeLinksForEmail }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($SafeLinksPolicies.Count) Safe Links policy/policies have URL comparison with block-list enabled."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SafeLinksPolicies.Count) Safe Links policy/policies do not have URL scanning enabled:`n`n"
+            $Result += "| Policy Name | Safe Links for Email |`n"
+            $Result += "| :---------- | :------------------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Name) | $($Policy.EnableSafeLinksForEmail) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO151' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'URL comparison with block-list SHOULD be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'URL comparison with block-list SHOULD be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO151' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO152.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO152.md
new file mode 100644
index 000000000000..db04d60a9e24
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO152.md
@@ -0,0 +1,22 @@
+Real-time suspicious URL and file-link scanning SHOULD be enabled.
+
+Real-time scanning checks suspicious URLs at the time of click, even if the URL wasn't initially identified as malicious. This provides additional protection against rapidly evolving threats and newly created malicious websites.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Safe Links
+2. Select each Safe Links policy
+3. Under "URL & click protection settings":
+   - Enable "Apply Safe Links to email messages sent within the organization"
+   - Enable "Apply real-time URL scanning for suspicious links and links that point to files"
+4. Or use PowerShell:
+```powershell
+Set-SafeLinksPolicy -Identity "Default" -ScanUrls $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.15.2](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo152v1)
+- [Set up Safe Links policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO152.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO152.ps1
new file mode 100644
index 000000000000..2239e1c116d5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO152.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO152 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.15.2 - Real-time suspicious URL and file-link scanning SHOULD be enabled
+
+    .DESCRIPTION
+    Checks if Safe Links policies have real-time link scanning enabled
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SafeLinksPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicy'
+
+        if (-not $SafeLinksPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoSafeLinksPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Real-time suspicious URL scanning SHOULD be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO152' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = $SafeLinksPolicies | Where-Object { -not $_.ScanUrls }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($SafeLinksPolicies.Count) Safe Links policy/policies have real-time URL scanning enabled."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SafeLinksPolicies.Count) Safe Links policy/policies do not have real-time URL scanning enabled:`n`n"
+            $Result += "| Policy Name | Scan URLs |`n"
+            $Result += "| :---------- | :-------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Name) | $($Policy.ScanUrls) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO152' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Real-time suspicious URL scanning SHOULD be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Real-time suspicious URL scanning SHOULD be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO152' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO153.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO153.md
new file mode 100644
index 000000000000..f8c99f40da39
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO153.md
@@ -0,0 +1,21 @@
+User click tracking SHOULD be disabled.
+
+Click tracking in Safe Links can collect information about which URLs users click, which may raise privacy concerns. CISA recommends disabling this feature to protect user privacy while still maintaining URL protection capabilities.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Safe Links
+2. Select each Safe Links policy
+3. Under "URL & click protection settings":
+   - Disable "Track user clicks"
+4. Or use PowerShell:
+```powershell
+Set-SafeLinksPolicy -Identity "Default" -TrackUserClicks $false
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.15.3](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo153v1)
+- [Set up Safe Links policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO153.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO153.ps1
new file mode 100644
index 000000000000..bd23744fabca
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO153.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestCISAMSEXO153 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.15.3 - User click tracking SHOULD be disabled
+
+    .DESCRIPTION
+    Checks if Safe Links policies have click tracking disabled for privacy
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SafeLinksPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicy'
+
+        if (-not $SafeLinksPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoSafeLinksPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'User click tracking SHOULD be disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO153' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = $SafeLinksPolicies | Where-Object { $_.TrackUserClicks -eq $true }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: All $($SafeLinksPolicies.Count) Safe Links policy/policies have click tracking disabled."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) of $($SafeLinksPolicies.Count) Safe Links policy/policies have click tracking enabled:`n`n"
+            $Result += "| Policy Name | Track User Clicks |`n"
+            $Result += "| :---------- | :---------------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Name) | $($Policy.TrackUserClicks) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO153' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'User click tracking SHOULD be disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'User click tracking SHOULD be disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO153' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO171.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO171.md
new file mode 100644
index 000000000000..677b8a837248
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO171.md
@@ -0,0 +1,19 @@
+Microsoft Purview Audit (Standard) logging SHALL be enabled.
+
+Audit logging captures user and administrator activities across Microsoft 365 services, providing essential forensic data for security investigations, compliance requirements, and detecting unauthorized access or data breaches.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft Purview compliance portal > Audit
+2. Turn on audit log search
+3. Or use PowerShell:
+```powershell
+Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.17.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo171v1)
+- [Turn audit log search on or off](https://learn.microsoft.com/purview/audit-log-enable-disable)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO171.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO171.ps1
new file mode 100644
index 000000000000..f4f0dfa93e3a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO171.ps1
@@ -0,0 +1,46 @@
+function Invoke-CippTestCISAMSEXO171 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.17.1 - Microsoft Purview Audit (Standard) logging SHALL be enabled
+
+    .DESCRIPTION
+    Checks if unified audit log ingestion is enabled
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $AuditConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAdminAuditLogConfig'
+
+        if (-not $AuditConfig) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoAdminAuditLogConfig cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Microsoft Purview Audit logging SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance' -TestId 'CISAMSEXO171' -TenantFilter $Tenant
+            return
+        }
+
+        $AuditConfigObject = $AuditConfig | Select-Object -First 1
+
+        if ($AuditConfigObject.UnifiedAuditLogIngestionEnabled -eq $true) {
+            $Result = "✅ **Pass**: Microsoft Purview Audit (Standard) logging is enabled.`n`n"
+            $Result += "**Current Settings:**`n"
+            $Result += "- UnifiedAuditLogIngestionEnabled: $($AuditConfigObject.UnifiedAuditLogIngestionEnabled)"
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: Microsoft Purview Audit (Standard) logging is not enabled.`n`n"
+            $Result += "**Current Settings:**`n"
+            $Result += "- UnifiedAuditLogIngestionEnabled: $($AuditConfigObject.UnifiedAuditLogIngestionEnabled)"
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO171' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Microsoft Purview Audit logging SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Microsoft Purview Audit logging SHALL be enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance' -TestId 'CISAMSEXO171' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO173.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO173.md
new file mode 100644
index 000000000000..32dcbc6e2f79
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO173.md
@@ -0,0 +1,22 @@
+Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (1 year).
+
+Maintaining audit logs for an adequate retention period is essential for security investigations, compliance audits, and meeting federal record-keeping requirements. A minimum of one year retention allows organizations to investigate incidents and establish historical baselines.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft Purview compliance portal > Data lifecycle management > Microsoft 365 retention > Retention policies
+2. Create or modify retention policy for audit logs
+3. Or use PowerShell:
+```powershell
+# Enable admin audit logging (provides 1 year retention)
+Set-AdminAuditLogConfig -AdminAuditLogEnabled $true
+
+# For longer retention, configure retention policies in Purview
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.17.3](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo173v1)
+- [Audit log retention policies](https://learn.microsoft.com/purview/audit-log-retention-policies)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO173.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO173.ps1
new file mode 100644
index 000000000000..e42677ae6d3a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO173.ps1
@@ -0,0 +1,46 @@
+function Invoke-CippTestCISAMSEXO173 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.17.3 - Audit logs SHALL be maintained for at least the minimum duration
+
+    .DESCRIPTION
+    Checks if admin audit log is enabled (provides 1 year retention)
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $AuditConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAdminAuditLogConfig'
+
+        if (-not $AuditConfig) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoAdminAuditLogConfig cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'Audit logs SHALL be maintained for at least 1 year' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance' -TestId 'CISAMSEXO173' -TenantFilter $Tenant
+            return
+        }
+
+        $AuditConfigObject = $AuditConfig | Select-Object -First 1
+
+        if ($AuditConfigObject.AdminAuditLogEnabled -eq $true) {
+            $Result = "✅ **Pass**: Admin audit log is enabled (provides 1 year retention).`n`n"
+            $Result += "**Current Settings:**`n"
+            $Result += "- AdminAuditLogEnabled: $($AuditConfigObject.AdminAuditLogEnabled)"
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: Admin audit log is not enabled.`n`n"
+            $Result += "**Current Settings:**`n"
+            $Result += "- AdminAuditLogEnabled: $($AuditConfigObject.AdminAuditLogEnabled)"
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO173' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Audit logs SHALL be maintained for at least 1 year' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Audit logs SHALL be maintained for at least 1 year' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Audit & Compliance' -TestId 'CISAMSEXO173' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO31.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO31.md
new file mode 100644
index 000000000000..4cb5dc494993
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO31.md
@@ -0,0 +1,27 @@
+DKIM SHOULD be enabled for all domains.
+
+DomainKeys Identified Mail (DKIM) adds a digital signature to outgoing email messages, allowing receiving mail servers to verify that the email actually came from your domain and wasn't altered in transit. This helps prevent email spoofing and improves email deliverability.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > DKIM
+2. For each domain:
+   - Select the domain
+   - Click "Create DKIM keys" if not already created
+   - Publish the CNAME records to DNS
+   - Enable DKIM signing
+3. Or use PowerShell:
+```powershell
+# Create DKIM signing configuration
+New-DkimSigningConfig -DomainName "contoso.com" -Enabled $true
+
+# Enable existing DKIM configuration
+Set-DkimSigningConfig -Identity "contoso.com" -Enabled $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.3.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo31v1)
+- [Use DKIM to validate outbound email](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-dkim-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO31.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO31.ps1
new file mode 100644
index 000000000000..5b2af1f957d1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO31.ps1
@@ -0,0 +1,68 @@
+function Invoke-CippTestCISAMSEXO31 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.3.1 - DKIM SHOULD be enabled for all domains
+
+    .DESCRIPTION
+    Checks if DKIM (DomainKeys Identified Mail) signing is enabled for all accepted domains
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $DkimConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoDkimSigningConfig'
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $DkimConfigs -or -not $AcceptedDomains) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'Required cache (ExoDkimSigningConfig or ExoAcceptedDomains) not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'DKIM SHOULD be enabled for all domains' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Authentication' -TestId 'CISAMSEXO31' -TenantFilter $Tenant
+            return
+        }
+
+        # Filter to non-internal accepted domains
+        $SendingDomains = $AcceptedDomains | Where-Object { -not $_.SendingFromDomainDisabled }
+
+        if (($SendingDomains | Measure-Object).Count -eq 0) {
+            Add-CippTestResult -Status 'Passed' -ResultMarkdown '✅ **Pass**: No sending domains found to check DKIM configuration.' -Risk 'Medium' -Name 'DKIM SHOULD be enabled for all domains' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Authentication' -TestId 'CISAMSEXO31' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedDomains = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Domain in $SendingDomains) {
+            $DkimConfig = $DkimConfigs | Where-Object { $_.Domain -eq $Domain.DomainName }
+
+            if (-not $DkimConfig -or -not $DkimConfig.Enabled) {
+                $FailedDomains.Add([PSCustomObject]@{
+                    'Domain' = $Domain.DomainName
+                    'DKIM Enabled' = if ($DkimConfig) { $DkimConfig.Enabled } else { 'Not Configured' }
+                    'Status' = if (-not $DkimConfig) { 'No DKIM config found' } else { 'DKIM disabled' }
+                })
+            }
+        }
+
+        if ($FailedDomains.Count -eq 0) {
+            $Result = "✅ **Pass**: DKIM is enabled for all $($SendingDomains.Count) sending domain(s)."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedDomains.Count) of $($SendingDomains.Count) domain(s) do not have DKIM properly enabled:`n`n"
+            $Result += "| Domain | DKIM Enabled | Status |`n"
+            $Result += "| :----- | :----------- | :----- |`n"
+            foreach ($Domain in $FailedDomains) {
+                $Result += "| $($Domain.Domain) | $($Domain.'DKIM Enabled') | $($Domain.Status) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO31' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'DKIM SHOULD be enabled for all domains' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Authentication'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'DKIM SHOULD be enabled for all domains' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Email Authentication' -TestId 'CISAMSEXO31' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO51.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO51.md
new file mode 100644
index 000000000000..4df1e83a5c56
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO51.md
@@ -0,0 +1,23 @@
+SMTP AUTH SHALL be disabled in Exchange Online.
+
+SMTP AUTH is a legacy authentication protocol that doesn't support modern security features like multi-factor authentication. Disabling SMTP AUTH reduces the attack surface and forces applications to use more secure authentication methods like OAuth 2.0.
+
+**Remediation Action:**
+
+1. Navigate to Exchange Admin Center > Mail flow > SMTP AUTH
+2. Disable SMTP AUTH for all users or specific users
+3. Or use PowerShell to disable organization-wide:
+```powershell
+Set-TransportConfig -SmtpClientAuthenticationDisabled $true
+```
+4. Or disable per-mailbox:
+```powershell
+Set-CASMailbox -Identity user@domain.com -SmtpClientAuthenticationDisabled $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.5.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo51v1)
+- [Disable SMTP AUTH](https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO51.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO51.ps1
new file mode 100644
index 000000000000..91e6390de0a8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO51.ps1
@@ -0,0 +1,51 @@
+function Invoke-CippTestCISAMSEXO51 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.5.1 - SMTP AUTH SHALL be disabled for all users
+
+    .DESCRIPTION
+    Checks if SMTP authentication is disabled in CAS Mailbox settings
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $CASMailboxes = New-CIPPDbRequest -TenantFilter $Tenant -Type 'CASMailbox'
+
+        if (-not $CASMailboxes) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'CASMailbox cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'SMTP AUTH SHALL be disabled in Exchange Online' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Email Authentication' -TestId 'CISAMSEXO51' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedMailboxes = $CASMailboxes | Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false }
+
+        if ($FailedMailboxes.Count -eq 0) {
+            $Result = "✅ **Pass**: SMTP authentication is disabled for all $($CASMailboxes.Count) mailbox(es)."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedMailboxes.Count) of $($CASMailboxes.Count) mailbox(es) have SMTP authentication enabled"
+            if ($FailedMailboxes.Count -gt 10) {
+                $Result += ' (showing first 10)'
+            }
+            $Result += ":`n`n"
+            $Result += "| Display Name | Identity | SMTP Auth Disabled |`n"
+            $Result += "| :----------- | :------- | :----------------- |`n"
+            foreach ($Mailbox in ($FailedMailboxes | Select-Object -First 10)) {
+                $Result += "| $($Mailbox.DisplayName) | $($Mailbox.Identity) | $($Mailbox.SmtpClientAuthenticationDisabled) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO51' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'SMTP AUTH SHALL be disabled in Exchange Online' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Email Authentication'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'SMTP AUTH SHALL be disabled in Exchange Online' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Email Authentication' -TestId 'CISAMSEXO51' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO61.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO61.md
new file mode 100644
index 000000000000..94c2efba5523
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO61.md
@@ -0,0 +1,20 @@
+Contact folders SHALL NOT be shared with all domains, although they MAY be shared with specific domains.
+
+Sharing contact folders with external domains can expose sensitive organizational information. Limiting contact sharing to specific approved domains reduces the risk of information disclosure.
+
+**Remediation Action:**
+
+1. Navigate to Exchange Admin Center > Organization > Sharing
+2. Review sharing policies
+3. Remove or modify policies that allow contact sharing with all domains
+4. Or use PowerShell:
+```powershell
+Set-SharingPolicy -Identity "Default Sharing Policy" -Domains @{Remove="*:ContactsSharing"}
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.6.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo61v1)
+- [Sharing policies in Exchange Online](https://learn.microsoft.com/exchange/sharing/sharing-policies/sharing-policies)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO61.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO61.ps1
new file mode 100644
index 000000000000..cbcdc07b90b0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO61.ps1
@@ -0,0 +1,61 @@
+function Invoke-CippTestCISAMSEXO61 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.6.1 - Contact folders SHALL NOT be shared with all domains
+
+    .DESCRIPTION
+    Checks if sharing policies allow sharing contact folders with external domains
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SharingPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSharingPolicy'
+
+        if (-not $SharingPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoSharingPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'Contact folders SHALL NOT be shared with all domains' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data Protection' -TestId 'CISAMSEXO61' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $SharingPolicies) {
+            if ($Policy.Enabled) {
+                # Check if any domain allows contact sharing (ContactsSharing capability)
+                $ContactSharingDomains = $Policy.Domains | Where-Object { $_ -match 'ContactsSharing' }
+                if ($ContactSharingDomains) {
+                    $FailedPolicies.Add([PSCustomObject]@{
+                            'Policy Name' = $Policy.Name
+                            'Enabled'     = $Policy.Enabled
+                            'Issue'       = 'Allows contact sharing with external domains'
+                        })
+                }
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = '✅ **Pass**: No sharing policies allow contact folder sharing with external domains.'
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) sharing policy/policies allow contact folder sharing:`n`n"
+            $Result += "| Policy Name | Enabled | Issue |`n"
+            $Result += "| :---------- | :------ | :---- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.'Policy Name') | $($Policy.Enabled) | $($Policy.Issue) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO61' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Contact folders SHALL NOT be shared with all domains' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Contact folders SHALL NOT be shared with all domains' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data Protection' -TestId 'CISAMSEXO61' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO62.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO62.md
new file mode 100644
index 000000000000..22e7bfad4310
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO62.md
@@ -0,0 +1,24 @@
+Calendar details SHALL NOT be shared with all domains, although they MAY be shared with specific domains.
+
+Sharing detailed calendar information (including meeting subjects, locations, and attendees) with all external domains can expose sensitive business information. Limiting detailed calendar sharing to specific approved domains protects organizational privacy.
+
+**Remediation Action:**
+
+1. Navigate to Exchange Admin Center > Organization > Sharing
+2. Review sharing policies
+3. Ensure wildcard (*) domains only allow free/busy time, not detailed information
+4. Or use PowerShell:
+```powershell
+# Allow only free/busy with all domains
+Set-SharingPolicy -Identity "Default Sharing Policy" -Domains "*:CalendarSharingFreeBusySimple"
+
+# For specific domains, you can allow details
+Set-SharingPolicy -Identity "Default Sharing Policy" -Domains @{Add="partner.com:CalendarSharingFreeBusyDetail"}
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.6.2](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo62v1)
+- [Sharing policies in Exchange Online](https://learn.microsoft.com/exchange/sharing/sharing-policies/sharing-policies)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO62.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO62.ps1
new file mode 100644
index 000000000000..378995d9e126
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO62.ps1
@@ -0,0 +1,62 @@
+function Invoke-CippTestCISAMSEXO62 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.6.2 - Calendar details SHALL NOT be shared with all domains
+
+    .DESCRIPTION
+    Checks if sharing policies allow sharing calendar details with external domains
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $SharingPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSharingPolicy'
+
+        if (-not $SharingPolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoSharingPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'Calendar details SHALL NOT be shared with all domains' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data Protection' -TestId 'CISAMSEXO62' -TenantFilter $Tenant
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $SharingPolicies) {
+            if ($Policy.Enabled) {
+                # Check if wildcard domain (*) allows detailed calendar sharing
+                $WildcardDomains = $Policy.Domains | Where-Object { $_ -match '^\*:' -and $_ -match 'CalendarSharing(FreeBusyDetail|All)' }
+                if ($WildcardDomains) {
+                    $FailedPolicies.Add([PSCustomObject]@{
+                        'Policy Name' = $Policy.Name
+                        'Enabled' = $Policy.Enabled
+                        'Issue' = 'Allows detailed calendar sharing with all domains'
+                        'Domains' = ($WildcardDomains -join ', ')
+                    })
+                }
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = "✅ **Pass**: No sharing policies allow detailed calendar sharing with all domains."
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) sharing policy/policies allow detailed calendar sharing with all domains:`n`n"
+            $Result += "| Policy Name | Enabled | Issue |`n"
+            $Result += "| :---------- | :------ | :---- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.'Policy Name') | $($Policy.Enabled) | $($Policy.Issue) |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO62' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Calendar details SHALL NOT be shared with all domains' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Calendar details SHALL NOT be shared with all domains' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data Protection' -TestId 'CISAMSEXO62' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.md
new file mode 100644
index 000000000000..1bda7cbc9a3d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.md
@@ -0,0 +1,20 @@
+External sender warnings SHALL be implemented.
+
+External sender warnings help users identify emails from outside the organization, reducing the risk of phishing and social engineering attacks. This visual indicator alerts users to exercise caution when interacting with external emails.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies
+2. Under "Rules", select "External sender"
+3. Enable external sender warnings
+4. Or use PowerShell:
+```powershell
+Set-ExternalInOutlook -Enabled $true
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.7.1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo71v1)
+- [External sender warnings](https://learn.microsoft.com/microsoft-365/security/office-365-security/external-email-forwarding)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.ps1
new file mode 100644
index 000000000000..e45af03bb0e7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.ps1
@@ -0,0 +1,44 @@
+function Invoke-CippTestCISAMSEXO71 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.7.1 - External sender warnings SHALL be implemented
+
+    .DESCRIPTION
+    Checks if external sender warnings are enabled in Exchange Online organization config
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $OrgConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoOrganizationConfig'
+
+        if (-not $OrgConfig) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoOrganizationConfig cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'External sender warnings SHALL be implemented' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO71' -TenantFilter $Tenant
+            return
+        }
+
+        $OrgConfigObject = $OrgConfig | Select-Object -First 1
+
+        if ($OrgConfigObject.ExternalInOutlook -eq $true) {
+            $Result = '✅ **Pass**: External sender warnings are enabled in Outlook.'
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: External sender warnings are not enabled in Outlook.`n`n"
+            $Result += "**Current Setting:**`n"
+            $Result += "- ExternalInOutlook: $($OrgConfigObject.ExternalInOutlook)"
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO71' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'External sender warnings SHALL be implemented' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'External sender warnings SHALL be implemented' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO71' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO95.md b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO95.md
new file mode 100644
index 000000000000..1b8d550197e9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO95.md
@@ -0,0 +1,22 @@
+At a minimum, click-to-run files SHOULD be blocked (e.g., .exe, .cmd, and .vbe).
+
+Blocking executable file types prevents users from receiving and potentially executing malicious files through email. These file types are commonly used in malware attacks and social engineering campaigns.
+
+**Remediation Action:**
+
+1. Navigate to Microsoft 365 Defender portal > Email & collaboration > Policies & rules > Threat policies > Anti-malware
+2. Select the malware filter policy to edit
+3. Under "Protection settings":
+   - Enable "Enable the common attachments filter"
+   - Ensure the blocked file types include at minimum: cmd, exe, vbe
+4. Or use PowerShell:
+```powershell
+Set-MalwareFilterPolicy -Identity "Default" -EnableFileFilter $true -FileTypes @("ace","ani","app","cab","docm","exe","jar","reg","scr","vbe","vbs","cmd","bat","com","cpl","dll","exe","hta","inf","ins","isp","js","jse","lib","lnk","mde","msc","msp","mst","pif","scr","sct","shb","sys","vb","vbe","vbs","vxd","wsc","wsf","wsh")
+```
+
+**Links:**
+- [CISA SCubaGear EXO Baseline - MS.EXO.9.5](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md#msexo95v1)
+- [Configure anti-malware policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-protection-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO95.ps1 b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO95.ps1
new file mode 100644
index 000000000000..ebdb715ac779
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO95.ps1
@@ -0,0 +1,74 @@
+function Invoke-CippTestCISAMSEXO95 {
+    <#
+    .SYNOPSIS
+    Tests MS.EXO.9.5 - At a minimum, click-to-run files SHOULD be blocked
+
+    .DESCRIPTION
+    Checks if malware filter policies block click-to-run executables (.exe, .cmd, .vbe)
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    try {
+        $MalwarePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicy'
+
+        if (-not $MalwarePolicies) {
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoMalwareFilterPolicy cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Click-to-run files SHOULD be blocked' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO95' -TenantFilter $Tenant
+            return
+        }
+
+        $RequiredBlockedTypes = @('cmd', 'exe', 'vbe')
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $MalwarePolicies) {
+            if (-not $Policy.EnableFileFilter) {
+                # Policy doesn't have file filtering enabled at all
+                $FailedPolicies.Add([PSCustomObject]@{
+                        'Policy Name'         = $Policy.Name
+                        'File Filter Enabled' = $false
+                        'Issue'               = 'File filtering not enabled'
+                    })
+                continue
+            }
+
+            # Check if required types are blocked
+            $BlockedTypes = $Policy.FileTypes
+            $MissingTypes = $RequiredBlockedTypes | Where-Object { $_ -notin $BlockedTypes }
+
+            if ($MissingTypes) {
+                $FailedPolicies.Add([PSCustomObject]@{
+                        'Policy Name'           = $Policy.Name
+                        'File Filter Enabled'   = $true
+                        'Missing Blocked Types' = ($MissingTypes -join ', ')
+                    })
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Result = '✅ **Pass**: All malware filter policies block click-to-run files (.exe, .cmd, .vbe).'
+            $Status = 'Passed'
+        } else {
+            $Result = "❌ **Fail**: $($FailedPolicies.Count) malware filter policy/policies do not properly block click-to-run executables:`n`n"
+            $Result += "| Policy Name | File Filter Enabled | Missing Blocked Types |`n"
+            $Result += "| :---------- | :------------------ | :-------------------- |`n"
+            foreach ($Policy in $FailedPolicies) {
+                $fileFilterValue = if ($Policy.'File Filter Enabled') { $Policy.'File Filter Enabled' } else { $Policy.'Issue' }
+                $missingTypes = if ($Policy.'Missing Blocked Types') { $Policy.'Missing Blocked Types' } else { 'N/A' }
+                $Result += "| $($Policy.'Policy Name') | $fileFilterValue | $missingTypes |`n"
+            }
+            $Status = 'Failed'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'CISAMSEXO95' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Click-to-run files SHOULD be blocked' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Email Protection'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Add-CippTestResult -Status 'Failed' -ResultMarkdown "Test execution failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Click-to-run files SHOULD be blocked' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO95' -TenantFilter $Tenant
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/CISA/report.json b/Modules/CIPPCore/Public/Tests/CISA/report.json
new file mode 100644
index 000000000000..75ac2ab1bb69
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/CISA/report.json
@@ -0,0 +1,33 @@
+{
+  "name": "CISA SCubaGear Tests for Exchange Online",
+  "description": "Security configuration assessment tests based on CISA's Secure Cloud Business Applications (SCubaGear) project for Microsoft Exchange Online. These tests validate compliance with federal security baselines.",
+  "version": "1.0",
+  "source": "https://github.com/cisagov/ScubaGear",
+  "category": "CISA Security Baselines",
+  "IdentityTests": [
+    "CISAMSEXO11",
+    "CISAMSEXO31",
+    "CISAMSEXO51",
+    "CISAMSEXO61",
+    "CISAMSEXO62",
+    "CISAMSEXO71",
+    "CISAMSEXO95",
+    "CISAMSEXO101",
+    "CISAMSEXO102",
+    "CISAMSEXO103",
+    "CISAMSEXO111",
+    "CISAMSEXO112",
+    "CISAMSEXO113",
+    "CISAMSEXO121",
+    "CISAMSEXO122",
+    "CISAMSEXO131",
+    "CISAMSEXO141",
+    "CISAMSEXO142",
+    "CISAMSEXO143",
+    "CISAMSEXO151",
+    "CISAMSEXO152",
+    "CISAMSEXO153",
+    "CISAMSEXO171",
+    "CISAMSEXO173"
+  ]
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF01.md
new file mode 100644
index 000000000000..2b4b263f7f43
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF01.md
@@ -0,0 +1,13 @@
+# FIDO2 - State
+
+FIDO2 security keys should be enabled as an authentication method to provide users with the strongest, most phishing-resistant form of authentication available. FIDO2 security keys use public key cryptography and are resistant to phishing, man-in-the-middle attacks, and password database breaches.
+
+Enabling FIDO2 security keys is a critical step toward passwordless authentication and provides the highest level of security for protecting user accounts, particularly for administrators and high-value targets.
+
+**Remediation action**
+- [Enable passwordless security key sign-in](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key)
+- [FIDO2 security key authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless)
+- [Plan a passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-deployment)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF01.ps1
new file mode 100644
index 000000000000..9da4913dad9e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF01.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestEIDSCAAF01 {
+    <#
+    .SYNOPSIS
+    FIDO2 - State
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'FIDO2 - State' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'FIDO2 configuration not found in Authentication Methods Policy.' -Risk 'Low' -Name 'FIDO2 - State' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        if ($Fido2Config.state -eq 'enabled') {
+            $Status = 'Passed'
+            $Result = 'FIDO2 authentication method is enabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+FIDO2 security keys should be enabled to provide strong, phishing-resistant authentication.
+
+**Current Configuration:**
+- State: $($Fido2Config.state)
+
+**Recommended Configuration:**
+- State: enabled
+
+Enabling FIDO2 provides users with a secure, passwordless authentication option.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'FIDO2 - State' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'FIDO2 - State' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF02.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF02.md
new file mode 100644
index 000000000000..fce0ae0868f6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF02.md
@@ -0,0 +1,13 @@
+# FIDO2 - Self-Service
+
+Self-service registration for FIDO2 security keys should be enabled to allow users to register their own security keys without requiring administrator intervention. This improves user experience and accelerates the adoption of passwordless authentication while maintaining security.
+
+Enabling self-service registration empowers users to take control of their authentication security and reduces the administrative burden of manually provisioning security keys for users.
+
+**Remediation action**
+- [Enable passwordless security key sign-in](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key)
+- [FIDO2 security key authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF02.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF02.ps1
new file mode 100644
index 000000000000..e10fe6994d4d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF02.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestEIDSCAAF02 {
+    <#
+    .SYNOPSIS
+    FIDO2 - Self-Service
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF02' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'FIDO2 - Self-Service' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'FIDO2 configuration not found in Authentication Methods Policy.' -Risk 'Low' -Name 'FIDO2 - Self-Service' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        if ($Fido2Config.isSelfServiceRegistrationAllowed -eq $true) {
+            $Status = 'Passed'
+            $Result = 'FIDO2 self-service registration is enabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+FIDO2 self-service registration should be enabled to allow users to register their own security keys.
+
+**Current Configuration:**
+- isSelfServiceRegistrationAllowed: $($Fido2Config.isSelfServiceRegistrationAllowed)
+
+**Recommended Configuration:**
+- isSelfServiceRegistrationAllowed: true
+
+Enabling self-service registration improves user experience and adoption of FIDO2 security keys.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF02' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'FIDO2 - Self-Service' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'FIDO2 - Self-Service' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF03.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF03.md
new file mode 100644
index 000000000000..a6747db56708
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF03.md
@@ -0,0 +1,13 @@
+# FIDO2 - Attestation
+
+FIDO2 attestation enforcement should be configured to ensure that only security keys from trusted manufacturers can be registered. Attestation allows Microsoft Entra ID to verify the authenticity and characteristics of FIDO2 security keys during registration, helping prevent the use of compromised or counterfeit devices.
+
+Enforcing attestation provides an additional layer of security by ensuring that only verified, legitimate FIDO2 security keys are used for authentication in your environment.
+
+**Remediation action**
+- [Enable passwordless security key sign-in](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key)
+- [FIDO2 security key authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF03.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF03.ps1
new file mode 100644
index 000000000000..64488cace6d6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF03.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestEIDSCAAF03 {
+    <#
+    .SYNOPSIS
+    FIDO2 - Attestation
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF03' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'FIDO2 - Attestation' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF03' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'FIDO2 configuration not found in Authentication Methods Policy.' -Risk 'Medium' -Name 'FIDO2 - Attestation' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        if ($Fido2Config.isAttestationEnforced -eq $true) {
+            $Status = 'Passed'
+            $Result = 'FIDO2 attestation enforcement is enabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+FIDO2 attestation should be enforced to verify the authenticity and security of FIDO2 security keys.
+
+**Current Configuration:**
+- isAttestationEnforced: $($Fido2Config.isAttestationEnforced)
+
+**Recommended Configuration:**
+- isAttestationEnforced: true
+
+Enforcing attestation ensures that only trusted and verified security keys can be registered.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF03' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'FIDO2 - Attestation' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF03' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'FIDO2 - Attestation' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF04.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF04.md
new file mode 100644
index 000000000000..7e4573cba30b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF04.md
@@ -0,0 +1,13 @@
+# FIDO2 - Key Restrictions
+
+FIDO2 key restrictions should be configured to control which security key models and manufacturers are allowed in your environment. Key restrictions help ensure that only approved, tested security keys that meet your organization's security requirements can be used for authentication.
+
+Organizations can use key restrictions to enforce specific security requirements such as requiring keys with certain certification levels or from approved vendors.
+
+**Remediation action**
+- [Enable passwordless security key sign-in](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key)
+- [FIDO2 security key authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless)
+- [Manage FIDO2 security key restrictions](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key#key-restrictions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF04.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF04.ps1
new file mode 100644
index 000000000000..9732628e81ff
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF04.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestEIDSCAAF04 {
+    <#
+    .SYNOPSIS
+    FIDO2 - Key Restrictions
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF04' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'FIDO2 - Key Restrictions' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'FIDO2 configuration not found in Authentication Methods Policy.' -Risk 'Medium' -Name 'FIDO2 - Key Restrictions' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        if ($Fido2Config.keyRestrictions.isEnforced -eq $true) {
+            $Status = 'Passed'
+            $Result = 'FIDO2 key restrictions are enforced'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+FIDO2 key restrictions should be enforced to control which security keys can be registered.
+
+**Current Configuration:**
+- keyRestrictions.isEnforced: $($Fido2Config.keyRestrictions.isEnforced)
+
+**Recommended Configuration:**
+- keyRestrictions.isEnforced: true
+
+Enforcing key restrictions helps ensure only approved security keys are used in your organization.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF04' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'FIDO2 - Key Restrictions' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'FIDO2 - Key Restrictions' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF05.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF05.md
new file mode 100644
index 000000000000..63735f222473
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF05.md
@@ -0,0 +1,13 @@
+# FIDO2 - Restricted Keys
+
+FIDO2 security key restrictions should be properly configured to define which specific keys are allowed or restricted in your environment. Organizations may choose to enforce key restrictions to ensure standardization, maintain approved vendor lists, or block specific key models that don't meet security requirements.
+
+Properly configured key restrictions help maintain consistent security standards across your FIDO2 security key deployment.
+
+**Remediation action**
+- [Enable passwordless security key sign-in](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key)
+- [FIDO2 security key authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless)
+- [Manage FIDO2 security key restrictions](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key#key-restrictions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF05.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF05.ps1
new file mode 100644
index 000000000000..24ca89ef8203
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF05.ps1
@@ -0,0 +1,48 @@
+function Invoke-CippTestEIDSCAAF05 {
+    <#
+    .SYNOPSIS
+    FIDO2 - Restricted Keys
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF05' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'FIDO2 - Restricted Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF05' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'FIDO2 configuration not found in Authentication Methods Policy.' -Risk 'Medium' -Name 'FIDO2 - Restricted Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        $aaGuids = $Fido2Config.keyRestrictions.aaGuids
+        if ($aaGuids -and $aaGuids.Count -gt 0) {
+            $Status = 'Passed'
+            $Result = "FIDO2 key restrictions have specific AAGuids configured ($($aaGuids.Count) GUIDs)"
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+FIDO2 key restrictions should specify AAGuids to control which authenticator models can be registered.
+
+**Current Configuration:**
+- keyRestrictions.aaGuids: Empty or not configured
+
+**Recommended Configuration:**
+- keyRestrictions.aaGuids: Should contain one or more AAGuids
+
+Specifying AAGuids allows you to restrict registration to specific, approved security key models.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF05' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'FIDO2 - Restricted Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF05' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'FIDO2 - Restricted Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF06.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF06.md
new file mode 100644
index 000000000000..a0b269b24c97
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF06.md
@@ -0,0 +1,13 @@
+# FIDO2 - Specific Keys
+
+FIDO2 specific key configurations should be reviewed to ensure that key restrictions align with your organization's security policies. Organizations may choose to allow all FIDO2-certified keys or restrict to specific models based on security requirements, user population, or procurement standards.
+
+The configuration of specific key allowances or restrictions should be based on a thorough assessment of your organization's security needs and risk tolerance.
+
+**Remediation action**
+- [Enable passwordless security key sign-in](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key)
+- [FIDO2 security key authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-passwordless)
+- [Manage FIDO2 security key restrictions](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key#key-restrictions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF06.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF06.ps1
new file mode 100644
index 000000000000..b0f8c58cf1c1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAF06.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestEIDSCAAF06 {
+    <#
+    .SYNOPSIS
+    FIDO2 - Specific Keys
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF06' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'FIDO2 - Specific Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF06' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'FIDO2 configuration not found in Authentication Methods Policy.' -Risk 'Medium' -Name 'FIDO2 - Specific Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+            return
+        }
+
+        $aaGuids = $Fido2Config.keyRestrictions.aaGuids
+        $enforcementType = $Fido2Config.keyRestrictions.enforcementType
+
+        if ($aaGuids -and $aaGuids.Count -gt 0 -and $enforcementType -in @('allow', 'block')) {
+            $Status = 'Passed'
+            $Result = "FIDO2 key restrictions are properly configured with enforcement type '$enforcementType' and $($aaGuids.Count) AAGuids"
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+FIDO2 key restrictions should have both AAGuids configured and a valid enforcement type (allow or block).
+
+**Current Configuration:**
+- keyRestrictions.aaGuids: $($aaGuids.Count) GUIDs configured
+- keyRestrictions.enforcementType: $enforcementType
+
+**Recommended Configuration:**
+- keyRestrictions.aaGuids: One or more AAGuids
+- keyRestrictions.enforcementType: 'allow' or 'block'
+
+Proper enforcement type ensures the AAGuids list is actively used to control key registration.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF06' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'FIDO2 - Specific Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAF06' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'FIDO2 - Specific Keys' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG01.md
new file mode 100644
index 000000000000..05b98d3029e7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG01.md
@@ -0,0 +1,13 @@
+# Authentication Methods - Policy Migration
+
+The authentication methods policy migration should be completed to use the modern authentication methods framework in Microsoft Entra ID. The modern policy provides enhanced features, better security controls, and improved management capabilities compared to legacy multi-factor authentication settings.
+
+Completing the migration ensures you can take advantage of new authentication features such as FIDO2 security keys, certificate-based authentication, and other modern authentication methods that are only available in the new policy framework.
+
+**Remediation action**
+- [Migrate to the authentication methods policy for Microsoft Entra multifactor authentication and SSPR](https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage)
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG01.ps1
new file mode 100644
index 000000000000..63161994f895
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG01.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAG01 {
+    <#
+    .SYNOPSIS
+    Authentication Methods - Policy Migration
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Authentication Methods - Policy Migration' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MigrationState = $AuthMethodsPolicy.policyMigrationState
+
+        if ($MigrationState -in @('migrationComplete', '')) {
+            $Status = 'Passed'
+            $Result = "Policy migration is complete or not applicable: $MigrationState"
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+The authentication methods policy migration should be complete.
+
+**Current Configuration:**
+- policyMigrationState: $MigrationState
+
+**Recommended Configuration:**
+- policyMigrationState: migrationComplete or empty
+
+Complete the migration to use the modern authentication methods policy.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Authentication Methods - Policy Migration' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Authentication Methods - Policy Migration' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG02.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG02.md
new file mode 100644
index 000000000000..a2412615831b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG02.md
@@ -0,0 +1,13 @@
+# Authentication Methods - Report Suspicious Activity
+
+Users should be enabled to report suspicious multifactor authentication prompts they did not initiate. This feature allows users to report fraudulent MFA attempts directly from the Microsoft Authenticator app or via phone call, which helps detect and prevent unauthorized access attempts and credential compromise.
+
+When users report suspicious activity, Microsoft Entra ID can take automated actions such as blocking the user's account, requiring a password reset, or triggering security alerts for administrators to investigate potential compromises.
+
+**Remediation action**
+- [Enable fraud alerts for Microsoft Entra multifactor authentication](https://learn.microsoft.com/entra/identity/authentication/howto-mfa-mfasettings#fraud-alert)
+- [Security defaults in Microsoft Entra ID](https://learn.microsoft.com/entra/fundamentals/security-defaults)
+- [What is Identity Protection in Microsoft Entra ID?](https://learn.microsoft.com/entra/id-protection/overview-identity-protection)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG02.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG02.ps1
new file mode 100644
index 000000000000..77244bc3cd59
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG02.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAG02 {
+    <#
+    .SYNOPSIS
+    Authentication Methods - Report Suspicious Activity
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG02' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Authentication Methods - Report Suspicious Activity' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $SuspiciousActivityState = $AuthMethodsPolicy.reportSuspiciousActivitySettings.state
+
+        if ($SuspiciousActivityState -eq 'enabled') {
+            $Status = 'Passed'
+            $Result = 'Report suspicious activity is enabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Report suspicious activity should be enabled to allow users to report fraudulent MFA attempts.
+
+**Current Configuration:**
+- reportSuspiciousActivitySettings.state: $SuspiciousActivityState
+
+**Recommended Configuration:**
+- reportSuspiciousActivitySettings.state: enabled
+
+This feature helps detect and prevent unauthorized access attempts.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG02' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Authentication Methods - Report Suspicious Activity' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Authentication Methods - Report Suspicious Activity' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG03.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG03.md
new file mode 100644
index 000000000000..0257a5905db5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG03.md
@@ -0,0 +1,13 @@
+# Authentication Methods - Suspicious Activity Target
+
+The report suspicious activity feature should target all users or specific groups to ensure comprehensive protection against unauthorized MFA attempts. Properly configuring which users can report suspicious activity ensures that security protections are applied consistently across your organization.
+
+Organizations should enable this feature for all users who use Microsoft Entra multifactor authentication to maximize the effectiveness of threat detection and response capabilities.
+
+**Remediation action**
+- [Enable fraud alerts for Microsoft Entra multifactor authentication](https://learn.microsoft.com/entra/identity/authentication/howto-mfa-mfasettings#fraud-alert)
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG03.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG03.ps1
new file mode 100644
index 000000000000..422f3b15eb38
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAG03.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAG03 {
+    <#
+    .SYNOPSIS
+    Authentication Methods - Suspicious Activity Target
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG03' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Authentication Methods - Suspicious Activity Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $IncludeTargetId = $AuthMethodsPolicy.reportSuspiciousActivitySettings.includeTarget.id
+
+        if ($IncludeTargetId -eq 'all_users') {
+            $Status = 'Passed'
+            $Result = 'Report suspicious activity is enabled for all users'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Report suspicious activity should be enabled for all users.
+
+**Current Configuration:**
+- reportSuspiciousActivitySettings.includeTarget.id: $IncludeTargetId
+
+**Recommended Configuration:**
+- reportSuspiciousActivitySettings.includeTarget.id: all_users
+
+All users should be able to report suspicious authentication attempts.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG03' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Authentication Methods - Suspicious Activity Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAG03' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Authentication Methods - Suspicious Activity Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM01.md
new file mode 100644
index 000000000000..75f687dea32f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM01.md
@@ -0,0 +1,13 @@
+# MS Authenticator - State
+
+Microsoft Authenticator should be enabled as an authentication method to provide users with a secure, phishing-resistant way to verify their identity. The Microsoft Authenticator app supports passwordless phone sign-in, push notifications for MFA, and time-based one-time passwords (TOTP).
+
+Enabling Microsoft Authenticator is a fundamental component of a strong authentication strategy and supports your organization's journey toward passwordless authentication.
+
+**Remediation action**
+- [Enable passwordless security key sign-in](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-security-key)
+- [Microsoft Authenticator authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app)
+- [Plan a passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-deployment)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM01.ps1
new file mode 100644
index 000000000000..2202e20fcf9e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM01.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestEIDSCAAM01 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - State
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'MS Authenticator - State' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.state -eq 'enabled') {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator authentication method is enabled.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator authentication method is not enabled. Current state: $($MethodConfig.state)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'MS Authenticator - State' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'MS Authenticator - State' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM02.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM02.md
new file mode 100644
index 000000000000..467cc16c7ce4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM02.md
@@ -0,0 +1,13 @@
+# MS Authenticator - OTP Disabled
+
+Software OATH tokens (time-based one-time passwords) in Microsoft Authenticator should be disabled in favor of push notifications, which provide stronger security and better user experience. Push notifications include additional context about the authentication request and are more resistant to phishing attacks compared to OTP codes that can be phished.
+
+Disabling OTP while keeping push notifications enabled encourages users to adopt the more secure authentication method while maintaining strong MFA protection.
+
+**Remediation action**
+- [Microsoft Authenticator authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app)
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+- [Plan a passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-deployment)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM02.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM02.ps1
new file mode 100644
index 000000000000..cb55407730d7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM02.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestEIDSCAAM02 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - OTP Disabled
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM02' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'MS Authenticator - OTP Disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.isSoftwareOathEnabled -eq $false) {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator software OATH is disabled.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator software OATH is enabled. It should be disabled."
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM02' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'MS Authenticator - OTP Disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'MS Authenticator - OTP Disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM03.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM03.md
new file mode 100644
index 000000000000..97cb1bfa6252
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM03.md
@@ -0,0 +1,13 @@
+# MS Authenticator - Number Matching
+
+Number matching should be enabled for Microsoft Authenticator push notifications to provide strong protection against MFA fatigue attacks and push notification bombing. With number matching, users must enter a number displayed on their sign-in screen into the Authenticator app, preventing them from accidentally approving fraudulent authentication requests.
+
+This feature significantly reduces the risk of users approving MFA prompts without proper verification, which is a common technique used by attackers in credential compromise scenarios.
+
+**Remediation action**
+- [How to use number matching in multifactor authentication (MFA) notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-number-match)
+- [Microsoft Authenticator authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app)
+- [System-preferred multifactor authentication](https://learn.microsoft.com/entra/identity/authentication/concept-system-preferred-multifactor-authentication)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM03.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM03.ps1
new file mode 100644
index 000000000000..074a1bd30f77
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM03.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestEIDSCAAM03 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - Number Matching
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM03' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'MS Authenticator - Number Matching' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.featureSettings.numberMatchingRequiredState.state -eq 'enabled') {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator number matching is enabled.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator number matching is not enabled. Current state: $($MethodConfig.featureSettings.numberMatchingRequiredState.state)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM03' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'MS Authenticator - Number Matching' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM03' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'MS Authenticator - Number Matching' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM04.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM04.md
new file mode 100644
index 000000000000..588342c08f87
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM04.md
@@ -0,0 +1,13 @@
+# MS Authenticator - Number Matching Target
+
+Number matching should be configured to target all users or appropriate user groups to ensure consistent security protections across your organization. Selective enablement may be appropriate during initial rollout phases, but the ultimate goal should be to enable number matching for all users performing MFA.
+
+Proper targeting configuration ensures that security improvements are applied consistently and that all users benefit from enhanced protection against MFA attacks.
+
+**Remediation action**
+- [How to use number matching in multifactor authentication (MFA) notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-number-match)
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM04.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM04.ps1
new file mode 100644
index 000000000000..aad48456a2c5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM04.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestEIDSCAAM04 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - Number Matching Target
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM04' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'MS Authenticator - Number Matching Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.featureSettings.numberMatchingRequiredState.includeTarget.id -eq 'all_users') {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator number matching targets all users.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator number matching does not target all users. Current target: $($MethodConfig.featureSettings.numberMatchingRequiredState.includeTarget.id)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM04' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'MS Authenticator - Number Matching Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'MS Authenticator - Number Matching Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM06.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM06.md
new file mode 100644
index 000000000000..c2a7016d510e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM06.md
@@ -0,0 +1,13 @@
+# MS Authenticator - Show App Name
+
+Application name should be displayed in Microsoft Authenticator push notifications to provide additional context that helps users identify legitimate authentication requests. Showing the app name allows users to verify that the authentication request is for the expected application, reducing the risk of approving fraudulent requests.
+
+This additional context is part of a defense-in-depth strategy that makes it harder for attackers to trick users into approving unauthorized authentication attempts.
+
+**Remediation action**
+- [Microsoft Authenticator authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app)
+- [How to use additional context in Microsoft Authenticator notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-additional-context)
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM06.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM06.ps1
new file mode 100644
index 000000000000..b9ee3660893a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM06.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestEIDSCAAM06 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - Show App Name
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM06' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'MS Authenticator - Show App Name' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.featureSettings.displayAppInformationRequiredState.state -eq 'enabled') {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator app information display is enabled.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator app information display is not enabled. Current state: $($MethodConfig.featureSettings.displayAppInformationRequiredState.state)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM06' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'MS Authenticator - Show App Name' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM06' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'MS Authenticator - Show App Name' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM07.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM07.md
new file mode 100644
index 000000000000..9d0853f77580
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM07.md
@@ -0,0 +1,13 @@
+# MS Authenticator - Show App Name Target
+
+Application name display should be configured to target appropriate user groups to ensure consistent security context is provided across your organization. Proper targeting ensures that all users receive additional context in their authentication prompts to help them make informed decisions about approving or denying authentication requests.
+
+Organizations should enable this feature for all users performing MFA to maximize security benefits.
+
+**Remediation action**
+- [How to use additional context in Microsoft Authenticator notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-additional-context)
+- [Microsoft Authenticator authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM07.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM07.ps1
new file mode 100644
index 000000000000..89ccd7d9e23b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM07.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestEIDSCAAM07 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - Show App Name Target
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM07' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'MS Authenticator - Show App Name Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.featureSettings.displayAppInformationRequiredState.includeTarget.id -eq 'all_users') {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator app information display targets all users.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator app information display does not target all users. Current target: $($MethodConfig.featureSettings.displayAppInformationRequiredState.includeTarget.id)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM07' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'MS Authenticator - Show App Name Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM07' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'MS Authenticator - Show App Name Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM09.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM09.md
new file mode 100644
index 000000000000..61680d77f924
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM09.md
@@ -0,0 +1,13 @@
+# MS Authenticator - Show Location
+
+Geographic location information should be displayed in Microsoft Authenticator push notifications to help users identify potentially suspicious authentication requests from unexpected locations. This additional context allows users to quickly recognize when an authentication attempt is coming from a location that doesn't match their current whereabouts.
+
+Location information is particularly useful for detecting credential compromise when attackers attempt to authenticate from different geographic regions.
+
+**Remediation action**
+- [How to use additional context in Microsoft Authenticator notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-additional-context)
+- [Microsoft Authenticator authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app)
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM09.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM09.ps1
new file mode 100644
index 000000000000..5a612085f473
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM09.ps1
@@ -0,0 +1,33 @@
+function Invoke-CippTestEIDSCAAM09 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - Show Location
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM09' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'MS Authenticator - Show Location' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.featureSettings.displayLocationInformationRequiredState.state -eq 'enabled') {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator location information display is enabled.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator location information display is not enabled. Current state: $($MethodConfig.featureSettings.displayLocationInformationRequiredState.state)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM09' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'MS Authenticator - Show Location' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM09' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'MS Authenticator - Show Location' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
+
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM10.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM10.md
new file mode 100644
index 000000000000..53ac29618499
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM10.md
@@ -0,0 +1,13 @@
+# MS Authenticator - Show Location Target
+
+Geographic location display should be configured to target appropriate user groups to ensure users receive location context in their authentication prompts. Proper targeting ensures security protections are applied consistently across your organization.
+
+Organizations should enable location display for all users performing MFA to maximize the security benefits and help users quickly identify suspicious authentication attempts.
+
+**Remediation action**
+- [How to use additional context in Microsoft Authenticator notifications](https://learn.microsoft.com/entra/identity/authentication/how-to-mfa-additional-context)
+- [Microsoft Authenticator authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-authenticator-app)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM10.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM10.ps1
new file mode 100644
index 000000000000..cff80ac7015d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAM10.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestEIDSCAAM10 {
+    <#
+    .SYNOPSIS
+    MS Authenticator - Show Location Target
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM10' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'MS Authenticator - Show Location Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $MethodConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if ($MethodConfig.featureSettings.displayLocationInformationRequiredState.includeTarget.id -eq 'all_users') {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator location information display targets all users.'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator location information display does not target all users. Current target: $($MethodConfig.featureSettings.displayLocationInformationRequiredState.includeTarget.id)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM10' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'MS Authenticator - Show Location Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAM10' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'MS Authenticator - Show Location Target' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP01.md
new file mode 100644
index 000000000000..5dfb019689e7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP01.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Self-Service Password Reset for Admins
+
+Administrators should not be allowed to use self-service password reset (SSPR) for enhanced security. Admin accounts require more stringent security controls and should follow formal password reset procedures that involve additional verification steps rather than self-service options. This ensures that administrative account password resets are properly audited and controlled.
+
+Allowing administrators to use SSPR increases the risk of account compromise, as SSPR methods may be vulnerable to social engineering or other attacks. Administrative accounts have elevated privileges and require the highest level of security protection.
+
+**Remediation action**
+- [Manage user settings for Microsoft Entra multifactor authentication](https://learn.microsoft.com/entra/identity/authentication/howto-mfa-userdevicesettings)
+- [Plan a Microsoft Entra self-service password reset deployment](https://learn.microsoft.com/entra/identity/authentication/howto-sspr-deployment)
+- [Microsoft Entra built-in roles](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP01.ps1
new file mode 100644
index 000000000000..366d944629ca
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP01.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAP01 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Self-Service Password Reset for Admins
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Authorization Policy - Self-Service Password Reset for Admins' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $AllowedToUseSSPR = $AuthorizationPolicy.allowedToUseSSPR
+
+        if ($AllowedToUseSSPR -eq $false) {
+            $Status = 'Passed'
+            $Result = 'Self-service password reset for administrators is disabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Self-service password reset for administrators should be disabled for enhanced security.
+
+**Current Configuration:**
+- allowedToUseSSPR: $AllowedToUseSSPR
+
+**Recommended Configuration:**
+- allowedToUseSSPR: false
+
+Administrators should follow more stringent password reset procedures rather than self-service options.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Authorization Policy - Self-Service Password Reset for Admins' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Authorization Policy - Self-Service Password Reset for Admins' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP04.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP04.md
new file mode 100644
index 000000000000..2a2a26bcc33a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP04.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Guest Invite Restrictions
+
+Guest invite permissions should be restricted to administrators and designated guest inviters only to maintain proper control over external access to your Microsoft Entra ID tenant. Limiting who can invite guests helps prevent unauthorized external users from accessing organizational resources and reduces the attack surface.
+
+When all users can invite guests, there is increased risk of data exposure and security incidents, as employees may inadvertently grant access to malicious actors or share sensitive information with unauthorized external parties.
+
+**Remediation action**
+- [Configure external collaboration settings](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure)
+- [Properties of a Microsoft Entra B2B collaboration user](https://learn.microsoft.com/entra/external-id/user-properties)
+- [Authorization policies in Microsoft Entra ID](https://learn.microsoft.com/graph/api/resources/authorizationpolicy)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP04.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP04.ps1
new file mode 100644
index 000000000000..8d45600068b9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP04.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAP04 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Guest Invite Restrictions
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP04' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Authorization Policy - Guest Invite Restrictions' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $AllowInvitesFrom = $AuthorizationPolicy.allowInvitesFrom
+
+        if ($AllowInvitesFrom -in @('adminsAndGuestInviters', 'none')) {
+            $Status = 'Passed'
+            $Result = "Guest invite restrictions are properly configured: $AllowInvitesFrom"
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Guest invite restrictions should be set to limit who can invite guests for enhanced security.
+
+**Current Configuration:**
+- allowInvitesFrom: $AllowInvitesFrom
+
+**Recommended Configuration:**
+- allowInvitesFrom: adminsAndGuestInviters OR none
+
+Restricting guest invitations helps maintain control over external access to your tenant.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP04' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Authorization Policy - Guest Invite Restrictions' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Authorization Policy - Guest Invite Restrictions' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP05.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP05.md
new file mode 100644
index 000000000000..58ff64d840a6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP05.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Email-Based Subscription Sign-up
+
+Users should not be allowed to sign up for email-based subscriptions that may create security risks or lead to unauthorized service usage. Disabling this feature prevents users from self-provisioning trial subscriptions or services that may not comply with organizational policies or security requirements.
+
+Allowing unrestricted subscription sign-up can lead to shadow IT, data sprawl, and increased security risks as users may store organizational data in unapproved services.
+
+**Remediation action**
+- [What is self-service sign-up for Microsoft Entra ID?](https://learn.microsoft.com/entra/identity/users/directory-self-service-signup)
+- [Authorization policies in Microsoft Entra ID](https://learn.microsoft.com/graph/api/resources/authorizationpolicy)
+- [Manage app and resource access using Microsoft Entra groups](https://learn.microsoft.com/entra/identity/users/groups-self-service-management)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP05.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP05.ps1
new file mode 100644
index 000000000000..45da15d78a26
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP05.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAP05 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Email-Based Subscription Sign-up
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP05' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Authorization Policy - Email-Based Subscription Sign-up' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $AllowedToSignUp = $AuthorizationPolicy.allowedToSignUpEmailBasedSubscriptions
+
+        if ($AllowedToSignUp -eq $false) {
+            $Status = 'Passed'
+            $Result = 'Email-based subscription sign-up is disabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Email-based subscription sign-up should be disabled to prevent unauthorized subscriptions.
+
+**Current Configuration:**
+- allowedToSignUpEmailBasedSubscriptions: $AllowedToSignUp
+
+**Recommended Configuration:**
+- allowedToSignUpEmailBasedSubscriptions: false
+
+Disabling email-based subscriptions helps maintain control over tenant access.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP05' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Authorization Policy - Email-Based Subscription Sign-up' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP05' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Authorization Policy - Email-Based Subscription Sign-up' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP06.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP06.md
new file mode 100644
index 000000000000..734390ded497
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP06.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Email Validation Join
+
+Users should not be allowed to join the tenant using email validation without proper administrative approval. This setting prevents unauthorized users from creating accounts in your tenant simply by validating an email address, which could lead to security breaches and unauthorized access.
+
+Requiring administrative control over tenant joins ensures that all user accounts are properly vetted and approved before gaining access to organizational resources.
+
+**Remediation action**
+- [What is self-service sign-up for Microsoft Entra ID?](https://learn.microsoft.com/entra/identity/users/directory-self-service-signup)
+- [Authorization policies in Microsoft Entra ID](https://learn.microsoft.com/graph/api/resources/authorizationpolicy)
+- [Manage external access in Microsoft Entra ID](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP06.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP06.ps1
new file mode 100644
index 000000000000..ffe03f08fd4a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP06.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAP06 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Email Validation Join
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP06' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Authorization Policy - Email Validation Join' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $AllowEmailVerified = $AuthorizationPolicy.allowEmailVerifiedUsersToJoinOrganization
+
+        if ($AllowEmailVerified -eq $false) {
+            $Status = 'Passed'
+            $Result = 'Users cannot join the tenant by email validation'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Email-validated users should not be allowed to join the organization to prevent unauthorized access.
+
+**Current Configuration:**
+- allowEmailVerifiedUsersToJoinOrganization: $AllowEmailVerified
+
+**Recommended Configuration:**
+- allowEmailVerifiedUsersToJoinOrganization: false
+
+Disabling this feature prevents unauthorized users from self-registering into your tenant.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP06' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Authorization Policy - Email Validation Join' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP06' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Authorization Policy - Email Validation Join' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP07.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP07.md
new file mode 100644
index 000000000000..0e8db3045137
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP07.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Guest User Access
+
+Guest user access should be restricted to limit what information external users can view and interact with in your tenant. The most restrictive setting ensures that guest users can only access their own profile information and cannot enumerate other users, groups, or organizational resources.
+
+Unrestricted guest access increases the risk of information disclosure and reconnaissance activities by external parties who may use directory information for targeted attacks.
+
+**Remediation action**
+- [Configure external collaboration settings](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure)
+- [Properties of a Microsoft Entra B2B collaboration user](https://learn.microsoft.com/entra/external-id/user-properties)
+- [Restrict guest access permissions in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/users/users-restrict-guest-permissions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP07.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP07.ps1
new file mode 100644
index 000000000000..dfbab3fe5197
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP07.ps1
@@ -0,0 +1,43 @@
+function Invoke-CippTestEIDSCAAP07 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Guest User Access
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP07' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Authorization Policy - Guest User Access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $GuestUserRoleId = $AuthorizationPolicy.guestUserRoleId
+        $ExpectedRoleId = '2af84b1e-32c8-42b7-82bc-daa82404023b'
+
+        if ($GuestUserRoleId -eq $ExpectedRoleId) {
+            $Status = 'Passed'
+            $Result = 'Guest user access is restricted (most restrictive)'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Guest user access should be set to the most restrictive level for enhanced security.
+
+**Current Configuration:**
+- guestUserRoleId: $GuestUserRoleId
+
+**Recommended Configuration:**
+- guestUserRoleId: $ExpectedRoleId (Most restrictive guest permissions)
+
+This setting limits what guest users can see and do in your directory.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP07' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Authorization Policy - Guest User Access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP07' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Authorization Policy - Guest User Access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP08.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP08.md
new file mode 100644
index 000000000000..41f3fa9eaa81
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP08.md
@@ -0,0 +1,13 @@
+# Authorization Policy - User Consent Policy
+
+User consent for applications should be limited to low-risk, publisher-verified applications only, or disabled entirely to prevent unauthorized data access. Unrestricted user consent allows users to grant applications access to organizational data without proper security review, potentially exposing sensitive information to malicious applications.
+
+Implementing a restrictive consent policy ensures that only trusted applications can access organizational resources and that high-risk permissions require administrator approval.
+
+**Remediation action**
+- [Configure how users consent to applications](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent)
+- [Manage app consent policies](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-app-consent-policies)
+- [Grant tenant-wide admin consent to an application](https://learn.microsoft.com/entra/identity/enterprise-apps/grant-admin-consent)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP08.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP08.ps1
new file mode 100644
index 000000000000..b727af3c1ba0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP08.ps1
@@ -0,0 +1,43 @@
+function Invoke-CippTestEIDSCAAP08 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - User Consent Policy
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP08' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Authorization Policy - User Consent Policy' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $ConsentPolicy = $AuthorizationPolicy.permissionGrantPolicyIdsAssignedToDefaultUserRole
+        $ExpectedPolicy = 'ManagePermissionGrantsForSelf.microsoft-user-default-low'
+
+        if ($ConsentPolicy -contains $ExpectedPolicy) {
+            $Status = 'Passed'
+            $Result = 'User consent policy is set to low-risk permissions'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+User consent policy should be configured to only allow consent for low-risk applications.
+
+**Current Configuration:**
+- permissionGrantPolicyIdsAssignedToDefaultUserRole: $($ConsentPolicy -join ', ')
+
+**Recommended Configuration:**
+- permissionGrantPolicyIdsAssignedToDefaultUserRole: $ExpectedPolicy
+
+This limits users to only consent to applications with low-risk permissions.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP08' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Authorization Policy - User Consent Policy' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP08' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Authorization Policy - User Consent Policy' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP09.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP09.md
new file mode 100644
index 000000000000..356e7e34f6e7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP09.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Consent for Risky Apps
+
+User consent for risky applications should be blocked to prevent users from granting dangerous permissions to untrusted applications. Risky apps may request excessive permissions or exhibit suspicious behavior that could compromise organizational security.
+
+Microsoft Entra ID can assess application risk based on various factors, and blocking consent for risky apps provides an additional layer of protection against malicious applications.
+
+**Remediation action**
+- [Configure how users consent to applications](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent)
+- [Manage app consent policies](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-app-consent-policies)
+- [Configure the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP09.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP09.ps1
new file mode 100644
index 000000000000..21919d35321d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP09.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAP09 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Consent for Risky Apps
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP09' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Authorization Policy - Consent for Risky Apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $AllowConsentRiskyApps = $AuthorizationPolicy.allowUserConsentForRiskyApps
+
+        if ($AllowConsentRiskyApps -eq $false) {
+            $Status = 'Passed'
+            $Result = 'User consent for risky apps is disabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+User consent for risk-based apps should be disabled to prevent users from consenting to potentially malicious applications.
+
+**Current Configuration:**
+- allowUserConsentForRiskyApps: $AllowConsentRiskyApps
+
+**Recommended Configuration:**
+- allowUserConsentForRiskyApps: false
+
+Disabling this prevents users from consenting to apps identified as risky.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP09' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Authorization Policy - Consent for Risky Apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP09' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Authorization Policy - Consent for Risky Apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP10.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP10.md
new file mode 100644
index 000000000000..2af59acc7c38
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP10.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Users Can Create Apps
+
+Regular users should not be allowed to register applications in Microsoft Entra ID. Application registration should be restricted to authorized administrators who can properly assess security implications and configure applications according to organizational policies.
+
+Allowing unrestricted app registration can lead to shadow IT, misconfigured applications, and potential security vulnerabilities as users may inadvertently create applications with excessive permissions or improper security settings.
+
+**Remediation action**
+- [Restrict who can create applications](https://learn.microsoft.com/entra/identity/role-based-access-control/delegate-app-roles#restrict-who-can-create-applications)
+- [Application and service principal objects in Microsoft Entra ID](https://learn.microsoft.com/entra/identity-platform/app-objects-and-service-principals)
+- [Authorization policies in Microsoft Entra ID](https://learn.microsoft.com/graph/api/resources/authorizationpolicy)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP10.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP10.ps1
new file mode 100644
index 000000000000..1de903c42d9d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP10.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAP10 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Users Can Create Apps
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP10' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Authorization Policy - Users Can Create Apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $AllowedToCreateApps = $AuthorizationPolicy.defaultUserRolePermissions.allowedToCreateApps
+
+        if ($AllowedToCreateApps -eq $false) {
+            $Status = 'Passed'
+            $Result = 'Users cannot create application registrations'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Users should not be allowed to create application registrations by default to maintain control over applications.
+
+**Current Configuration:**
+- defaultUserRolePermissions.allowedToCreateApps: $AllowedToCreateApps
+
+**Recommended Configuration:**
+- defaultUserRolePermissions.allowedToCreateApps: false
+
+Only authorized users should be able to register applications in your tenant.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP10' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Authorization Policy - Users Can Create Apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP10' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Authorization Policy - Users Can Create Apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP14.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP14.md
new file mode 100644
index 000000000000..0f5105117fa6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP14.md
@@ -0,0 +1,13 @@
+# Authorization Policy - Users Can Read Other Users
+
+Users should have the ability to read other users' basic profile information to enable collaboration and communication within the organization. However, this should be balanced with privacy and security considerations. This setting controls whether users can discover and view information about other users in the directory.
+
+Completely restricting user discovery may impact collaboration, while allowing full access enables normal business operations such as looking up colleagues, viewing organizational charts, and facilitating communication.
+
+**Remediation action**
+- [Authorization policies in Microsoft Entra ID](https://learn.microsoft.com/graph/api/resources/authorizationpolicy)
+- [Restrict member users default permissions](https://learn.microsoft.com/entra/fundamentals/users-default-permissions#restrict-member-users-default-permissions)
+- [What are default user permissions in Microsoft Entra ID?](https://learn.microsoft.com/entra/fundamentals/users-default-permissions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP14.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP14.ps1
new file mode 100644
index 000000000000..0e66fb8b39d4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAP14.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCAAP14 {
+    <#
+    .SYNOPSIS
+    Authorization Policy - Users Can Read Other Users
+    #>
+    param($Tenant)
+
+    try {
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP14' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Authorization Policy - Users Can Read Other Users' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+            return
+        }
+
+        $AllowedToReadOtherUsers = $AuthorizationPolicy.defaultUserRolePermissions.allowedToReadOtherUsers
+
+        if ($AllowedToReadOtherUsers -eq $true) {
+            $Status = 'Passed'
+            $Result = 'Users can read other users (standard behavior for collaboration)'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Users should be allowed to read other users' basic profile information for collaboration purposes.
+
+**Current Configuration:**
+- defaultUserRolePermissions.allowedToReadOtherUsers: $AllowedToReadOtherUsers
+
+**Recommended Configuration:**
+- defaultUserRolePermissions.allowedToReadOtherUsers: true
+
+This setting enables basic collaboration features like Teams and SharePoint.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP14' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Authorization Policy - Users Can Read Other Users' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAP14' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Authorization Policy - Users Can Read Other Users' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authorization Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.md
new file mode 100644
index 000000000000..fedf9dd8d1e1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.md
@@ -0,0 +1,13 @@
+# SMS - No Sign-In
+
+SMS should not be allowed as a primary authentication method (sign-in), though it may be used for multi-factor authentication verification. SMS is vulnerable to SIM swap attacks and interception, making it unsuitable as a standalone authentication factor. Organizations should enforce stronger authentication methods for sign-in while potentially allowing SMS only as a second factor.
+
+This configuration prevents users from signing in with SMS alone, which provides better security than allowing SMS-based authentication while still permitting SMS as an MFA option where appropriate.
+
+**Remediation action**
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+- [SMS-based authentication in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-phone-options)
+- [Plan a passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-deployment)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.ps1
new file mode 100644
index 000000000000..e40eacd00391
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.ps1
@@ -0,0 +1,56 @@
+function Invoke-CippTestEIDSCAAS04 {
+    <#
+    .SYNOPSIS
+    SMS - No Sign-In
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAS04' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'SMS - No Sign-In' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $SmsConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Sms' }
+
+        if (-not $SmsConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAS04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'SMS authentication configuration not found in Authentication Methods Policy.' -Risk 'High' -Name 'SMS - No Sign-In' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $InvalidTargets = @()
+        if ($SmsConfig.includeTargets) {
+            foreach ($target in $SmsConfig.includeTargets) {
+                if ($target.isUsableForSignIn -ne $false) {
+                    $InvalidTargets += $target.id
+                }
+            }
+        }
+
+        if ($InvalidTargets.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = 'SMS authentication is not allowed for sign-in on any targets'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+SMS should not be allowed for sign-in as it is vulnerable to SIM swap and interception attacks. SMS should only be used for MFA verification, not primary authentication.
+
+**Current Configuration:**
+- Targets with sign-in enabled: $($InvalidTargets.Count)
+
+**Recommended Configuration:**
+- All includeTargets should have isUsableForSignIn: false
+
+Disabling SMS for sign-in while keeping it for MFA provides better security.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAS04' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'SMS - No Sign-In' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAS04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'SMS - No Sign-In' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT01.md
new file mode 100644
index 000000000000..9ee13e31e76e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT01.md
@@ -0,0 +1,13 @@
+# Temp Access Pass - State
+
+Temporary Access Pass (TAP) should be enabled to facilitate secure onboarding of passwordless authentication methods. TAP provides a time-limited passcode that can be used once or multiple times to register strong authentication methods such as FIDO2 security keys or set up the Microsoft Authenticator app.
+
+Enabling TAP is particularly important for passwordless authentication rollouts, as it allows administrators to securely bootstrap users into passwordless methods without relying on traditional passwords or less secure alternatives.
+
+**Remediation action**
+- [Enable and configure Temporary Access Pass](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass)
+- [Temporary Access Pass authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-temporary-access-pass)
+- [Plan a passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-deployment)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT01.ps1
new file mode 100644
index 000000000000..4cd6c62e1388
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT01.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestEIDSCAAT01 {
+    <#
+    .SYNOPSIS
+    Temp Access Pass - State
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Temp Access Pass - State' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $TAPConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'TemporaryAccessPass' }
+
+        if (-not $TAPConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'Temporary Access Pass configuration not found in Authentication Methods Policy.' -Risk 'Medium' -Name 'Temp Access Pass - State' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        if ($TAPConfig.state -eq 'enabled') {
+            $Status = 'Passed'
+            $Result = 'Temporary Access Pass is enabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Temporary Access Pass should be enabled to facilitate secure onboarding of passwordless authentication methods.
+
+**Current Configuration:**
+- State: $($TAPConfig.state)
+
+**Recommended Configuration:**
+- State: enabled
+
+Enabling TAP allows administrators to securely onboard users to passwordless authentication.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Temp Access Pass - State' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Temp Access Pass - State' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT02.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT02.md
new file mode 100644
index 000000000000..cebafc0606cd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT02.md
@@ -0,0 +1,13 @@
+# Temp Access Pass - One-Time
+
+Temporary Access Pass should be configured with appropriate usage limits. Setting TAP to one-time use provides the highest security by ensuring the passcode cannot be reused after initial authentication. However, organizations may choose to allow multiple uses based on specific use cases such as registering multiple authentication methods.
+
+The configuration should balance security requirements with the specific use cases for TAP in your organization, such as user onboarding workflows or authentication method recovery scenarios.
+
+**Remediation action**
+- [Enable and configure Temporary Access Pass](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass)
+- [Temporary Access Pass authentication method](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-temporary-access-pass)
+- [Configure Temporary Access Pass properties](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass#configure-temporary-access-pass-settings)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT02.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT02.ps1
new file mode 100644
index 000000000000..0d8b91f7bb88
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAT02.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestEIDSCAAT02 {
+    <#
+    .SYNOPSIS
+    Temp Access Pass - One-Time
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT02' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Temp Access Pass - One-Time' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $TAPConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'TemporaryAccessPass' }
+
+        if (-not $TAPConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'Temporary Access Pass configuration not found in Authentication Methods Policy.' -Risk 'Medium' -Name 'Temp Access Pass - One-Time' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        if ($TAPConfig.isUsableOnce -eq $true) {
+            $Status = 'Passed'
+            $Result = 'Temporary Access Pass is configured for one-time use'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Temporary Access Pass should be configured for one-time use to minimize security risks.
+
+**Current Configuration:**
+- isUsableOnce: $($TAPConfig.isUsableOnce)
+
+**Recommended Configuration:**
+- isUsableOnce: true
+
+One-time use reduces the risk of TAP credential theft or misuse.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT02' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Temp Access Pass - One-Time' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAT02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Temp Access Pass - One-Time' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAV01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAV01.md
new file mode 100644
index 000000000000..6a462df66c70
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAV01.md
@@ -0,0 +1,13 @@
+# Voice Call - Disabled
+
+Voice call authentication should be disabled as it is vulnerable to social engineering attacks and SIM swap attacks. Voice calls are less secure than modern authentication methods and should be replaced with more secure alternatives such as the Microsoft Authenticator app or FIDO2 security keys.
+
+Attackers can intercept phone calls through SIM swapping or social engineering telecom providers, making voice calls an unreliable authentication factor. Organizations should migrate users to stronger authentication methods.
+
+**Remediation action**
+- [Authentication methods in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods)
+- [Plan a passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-passwordless-deployment)
+- [Manage authentication methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAV01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAV01.ps1
new file mode 100644
index 000000000000..3183898c4494
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAV01.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestEIDSCAAV01 {
+    <#
+    .SYNOPSIS
+    Voice Call - Disabled
+    #>
+    param($Tenant)
+
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAV01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Voice Call - Disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        $VoiceConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Voice' }
+
+        if (-not $VoiceConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAV01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'Voice authentication configuration not found in Authentication Methods Policy.' -Risk 'Medium' -Name 'Voice Call - Disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+            return
+        }
+
+        if ($VoiceConfig.state -eq 'disabled') {
+            $Status = 'Passed'
+            $Result = 'Voice call authentication is disabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Voice call authentication should be disabled as it is susceptible to social engineering and SIM swap attacks.
+
+**Current Configuration:**
+- State: $($VoiceConfig.state)
+
+**Recommended Configuration:**
+- State: disabled
+
+Disabling voice calls reduces the attack surface by eliminating a less secure authentication method.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAV01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Voice Call - Disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAAV01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Voice Call - Disabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Authentication Methods'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP01.md
new file mode 100644
index 000000000000..2efc4dc29552
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP01.md
@@ -0,0 +1,13 @@
+# Consent Policy Settings - Group owner consent for apps accessing data
+
+Group owners should not be allowed to consent to applications accessing group data without proper security review. Allowing group owners to consent to apps can lead to unauthorized data access, as group owners may not fully understand the security implications of granting permissions to third-party applications.
+
+This setting helps prevent data leakage by ensuring that all application consent requests go through proper administrative channels where security assessments can be performed.
+
+**Remediation action**
+- [Configure group owner consent to apps accessing group data](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent-groups)
+- [Manage app consent policies](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-app-consent-policies)
+- [Review permissions granted to applications](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-application-permissions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP01.ps1
new file mode 100644
index 000000000000..00a54c296493
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP01.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCACP01 {
+    <#
+    .SYNOPSIS
+    Consent Policy Settings - Group owner consent for apps accessing data
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Consent Policy Settings - Group owner consent for apps accessing data' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Consent Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'EnableGroupSpecificConsent' }).value
+
+        if ($SettingValue -eq 'False') {
+            $Status = 'Passed'
+            $Result = 'Group owner consent for apps is disabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Group owner consent should be disabled to prevent unauthorized app permissions.
+
+**Current Configuration:**
+- EnableGroupSpecificConsent: $SettingValue
+
+**Recommended Configuration:**
+- EnableGroupSpecificConsent: False
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Consent Policy Settings - Group owner consent for apps accessing data' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Consent Policy Settings - Group owner consent for apps accessing data' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP03.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP03.md
new file mode 100644
index 000000000000..c3cae6d32ba2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP03.md
@@ -0,0 +1,13 @@
+# Consent Policy Settings - Block user consent for risky apps
+
+User consent should be blocked for applications identified as risky by Microsoft to prevent potential security breaches. Microsoft Entra ID assesses application risk based on various signals, including publisher verification status, permissions requested, and application behavior patterns.
+
+Blocking consent for risky apps provides automatic protection against potentially malicious applications while still allowing users to consent to trusted, low-risk applications (if user consent is enabled).
+
+**Remediation action**
+- [Configure how users consent to applications](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-user-consent)
+- [Configure risk-based step-up consent](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-risk-based-step-up-consent)
+- [Manage app consent policies](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-app-consent-policies)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP03.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP03.ps1
new file mode 100644
index 000000000000..4ac4ac664034
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP03.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCACP03 {
+    <#
+    .SYNOPSIS
+    Consent Policy Settings - Block user consent for risky apps
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP03' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Consent Policy Settings - Block user consent for risky apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Consent Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'BlockUserConsentForRiskyApps' }).value
+
+        if ($SettingValue -eq 'true') {
+            $Status = 'Passed'
+            $Result = 'User consent for risky apps is blocked'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+User consent for risky apps should be blocked to prevent security risks.
+
+**Current Configuration:**
+- BlockUserConsentForRiskyApps: $SettingValue
+
+**Recommended Configuration:**
+- BlockUserConsentForRiskyApps: true
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP03' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Consent Policy Settings - Block user consent for risky apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP03' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Consent Policy Settings - Block user consent for risky apps' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP04.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP04.md
new file mode 100644
index 000000000000..8741778896b3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP04.md
@@ -0,0 +1,13 @@
+# Consent Policy Settings - Users can request admin consent
+
+Users should be allowed to request administrator consent when they need to use applications that require permissions beyond what they can grant themselves. This creates a formal workflow where users can submit requests for application access, and administrators can review and approve these requests after assessing security implications.
+
+Enabling this setting provides a balance between security and productivity, as users can request access to needed applications while ensuring proper oversight and approval processes are in place.
+
+**Remediation action**
+- [Configure the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow)
+- [Manage admin consent requests](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-consent-requests)
+- [Review permissions granted to applications](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-application-permissions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP04.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP04.ps1
new file mode 100644
index 000000000000..3b960e183ee1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACP04.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCACP04 {
+    <#
+    .SYNOPSIS
+    Consent Policy Settings - Users can request admin consent
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP04' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Consent Policy Settings - Users can request admin consent' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'EnableAdminConsentRequests' }).value
+
+        if ($SettingValue -eq 'true') {
+            $Status = 'Passed'
+            $Result = 'Users can request admin consent for apps'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Users should be able to request admin consent to enable proper app approval workflows.
+
+**Current Configuration:**
+- EnableAdminConsentRequests: $SettingValue
+
+**Recommended Configuration:**
+- EnableAdminConsentRequests: true
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP04' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Consent Policy Settings - Users can request admin consent' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACP04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Consent Policy Settings - Users can request admin consent' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR01.md
new file mode 100644
index 000000000000..9add1126ca1c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR01.md
@@ -0,0 +1,13 @@
+# Admin Consent - Enabled
+
+The admin consent request workflow should be enabled to provide a formal process for users to request administrator approval for applications requiring privileged permissions. This workflow creates visibility and control over application consent requests while allowing users to request access to applications they need for their work.
+
+Enabling the admin consent workflow provides a balance between security and productivity by ensuring administrators review high-risk permission requests while streamlining the process for users to request access to needed applications.
+
+**Remediation action**
+- [Configure the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow)
+- [Manage admin consent requests](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-consent-requests)
+- [Review permissions granted to applications](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-application-permissions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR01.ps1
new file mode 100644
index 000000000000..c75af77fc7d2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR01.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCACR01 {
+    <#
+    .SYNOPSIS
+    Admin Consent - Enabled
+    #>
+    param($Tenant)
+
+    try {
+        $AdminConsentPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AdminConsentRequestPolicy'
+
+        if (-not $AdminConsentPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Admin Consent - Enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+            return
+        }
+
+        if ($AdminConsentPolicy.isEnabled -eq $true) {
+            $Status = 'Passed'
+            $Result = 'Admin consent request workflow is enabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Admin consent request workflow should be enabled to allow users to request administrator approval for applications.
+
+**Current Configuration:**
+- isEnabled: $($AdminConsentPolicy.isEnabled)
+
+**Recommended Configuration:**
+- isEnabled: true
+
+Enabling this workflow provides a secure process for users to request access to applications requiring admin consent.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Admin Consent - Enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Admin Consent - Enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR02.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR02.md
new file mode 100644
index 000000000000..e78c2db619fc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR02.md
@@ -0,0 +1,13 @@
+# Admin Consent - Notify Reviewers
+
+Reviewers should be notified when new admin consent requests are submitted to ensure timely review and approval of application access requests. Enabling notifications ensures that consent requests don't go unnoticed and that users receive timely responses to their access requests.
+
+Proper notification configuration helps maintain a responsive admin consent workflow and improves the user experience while maintaining security oversight.
+
+**Remediation action**
+- [Configure the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow)
+- [Manage admin consent requests](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-consent-requests)
+- [Review and take action on admin consent requests](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-consent-requests#review-and-take-action-on-a-request)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR02.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR02.ps1
new file mode 100644
index 000000000000..a99a1c1d3502
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR02.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCACR02 {
+    <#
+    .SYNOPSIS
+    Admin Consent - Notify Reviewers
+    #>
+    param($Tenant)
+
+    try {
+        $AdminConsentPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AdminConsentRequestPolicy'
+
+        if (-not $AdminConsentPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR02' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Admin Consent - Notify Reviewers' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+            return
+        }
+
+        if ($AdminConsentPolicy.notifyReviewers -eq $true) {
+            $Status = 'Passed'
+            $Result = 'Admin consent reviewers are notified of new requests'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Admin consent reviewers should be notified when new consent requests are submitted.
+
+**Current Configuration:**
+- notifyReviewers: $($AdminConsentPolicy.notifyReviewers)
+
+**Recommended Configuration:**
+- notifyReviewers: true
+
+Enabling notifications ensures reviewers are promptly informed of pending consent requests.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR02' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Admin Consent - Notify Reviewers' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Admin Consent - Notify Reviewers' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR03.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR03.md
new file mode 100644
index 000000000000..82e9be1b5ac4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR03.md
@@ -0,0 +1,13 @@
+# Admin Consent - Reminders
+
+Reminders should be enabled for pending admin consent requests to ensure that reviewers don't forget to review and respond to user requests. Regular reminders help maintain an efficient consent workflow and prevent user frustration from delayed responses.
+
+Configuring appropriate reminder intervals ensures that consent requests are reviewed in a timely manner while not overwhelming reviewers with excessive notifications.
+
+**Remediation action**
+- [Configure the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow)
+- [Manage admin consent requests](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-consent-requests)
+- [Admin consent workflow settings](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow#configure-settings)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR03.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR03.ps1
new file mode 100644
index 000000000000..ead722796b07
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR03.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCACR03 {
+    <#
+    .SYNOPSIS
+    Admin Consent - Reminders
+    #>
+    param($Tenant)
+
+    try {
+        $AdminConsentPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AdminConsentRequestPolicy'
+
+        if (-not $AdminConsentPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR03' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Admin Consent - Reminders' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+            return
+        }
+
+        if ($AdminConsentPolicy.remindersEnabled -eq $true) {
+            $Status = 'Passed'
+            $Result = 'Admin consent request reminders are enabled'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Admin consent request reminders should be enabled to ensure timely review of pending requests.
+
+**Current Configuration:**
+- remindersEnabled: $($AdminConsentPolicy.remindersEnabled)
+
+**Recommended Configuration:**
+- remindersEnabled: true
+
+Enabling reminders helps prevent consent requests from being overlooked or delayed.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR03' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Admin Consent - Reminders' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR03' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Admin Consent - Reminders' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR04.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR04.md
new file mode 100644
index 000000000000..4ad8b36ab867
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR04.md
@@ -0,0 +1,13 @@
+# Admin Consent - Duration
+
+The admin consent request duration should be set to 30 days or less to ensure that consent requests are reviewed and processed in a timely manner. This setting controls how long consent requests remain active before they expire and need to be resubmitted.
+
+A shorter request duration ensures that pending consent requests don't accumulate indefinitely and encourages prompt review and decision-making by administrators. It also helps keep the consent request queue manageable and relevant.
+
+**Remediation action**
+- [Configure the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow)
+- [Manage admin consent requests](https://learn.microsoft.com/entra/identity/enterprise-apps/manage-consent-requests)
+- [Admin consent workflow settings](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow#configure-settings)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR04.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR04.ps1
new file mode 100644
index 000000000000..01c555a480e4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCACR04.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestEIDSCACR04 {
+    <#
+    .SYNOPSIS
+    Admin Consent - Duration
+    #>
+    param($Tenant)
+
+    try {
+        $AdminConsentPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AdminConsentRequestPolicy'
+
+        if (-not $AdminConsentPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR04' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Admin Consent - Duration' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+            return
+        }
+
+        $RequestDuration = $AdminConsentPolicy.requestDurationInDays
+
+        if ($RequestDuration -le 30) {
+            $Status = 'Passed'
+            $Result = "Admin consent request duration is set to $RequestDuration days (30 days or less)"
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Admin consent request duration should be set to 30 days or less to ensure timely review.
+
+**Current Configuration:**
+- requestDurationInDays: $RequestDuration
+
+**Recommended Configuration:**
+- requestDurationInDays: 30 or less
+
+A shorter duration ensures consent requests are reviewed and processed in a timely manner.
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR04' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Admin Consent - Duration' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCACR04' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Admin Consent - Duration' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Consent Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR01.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR01.md
new file mode 100644
index 000000000000..ab5f6ccb47f9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR01.md
@@ -0,0 +1,13 @@
+# Password Rule Settings - Password Protection Mode
+
+Password protection mode should be set to "Enforce" to actively block weak passwords and prevent users from setting passwords that appear on Microsoft's banned password list or your custom banned password list. When set to Enforce mode, weak password attempts are blocked in real-time, providing immediate protection against easily compromised credentials.
+
+Enforce mode applies to both cloud-only users and users whose passwords are synchronized from on-premises Active Directory (when Azure AD Password Protection for Windows Server Active Directory is deployed).
+
+**Remediation action**
+- [Plan and deploy on-premises Azure Active Directory Password Protection](https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy)
+- [Eliminate bad passwords using Azure Active Directory Password Protection](https://learn.microsoft.com/entra/identity/authentication/concept-password-ban-bad)
+- [Configure custom banned password list](https://learn.microsoft.com/entra/identity/authentication/tutorial-configure-custom-password-protection)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR01.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR01.ps1
new file mode 100644
index 000000000000..fb00648135f0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR01.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCAPR01 {
+    <#
+    .SYNOPSIS
+    Password Rule Settings - Password Protection Mode
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR01' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Password Rule Settings - Password Protection Mode' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Password Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'BannedPasswordCheckOnPremisesMode' }).value
+
+        if ($SettingValue -eq 'Enforce') {
+            $Status = 'Passed'
+            $Result = 'Password protection mode is set to Enforce'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Password protection mode should be set to Enforce to prevent weak passwords.
+
+**Current Configuration:**
+- BannedPasswordCheckOnPremisesMode: $SettingValue
+
+**Recommended Configuration:**
+- BannedPasswordCheckOnPremisesMode: Enforce
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR01' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Password Rule Settings - Password Protection Mode' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Password Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR01' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Password Rule Settings - Password Protection Mode' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Password Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR02.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR02.md
new file mode 100644
index 000000000000..b743add2288f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR02.md
@@ -0,0 +1,13 @@
+# Password Rule Settings - Enable password protection on Windows Server Active Directory
+
+Password protection should be enabled for on-premises Windows Server Active Directory to extend Microsoft Entra password protection to your hybrid environment. This ensures that weak passwords are blocked not only in the cloud but also when users set or change passwords on domain controllers.
+
+Enabling this feature requires deploying Azure AD Password Protection DC agents on your domain controllers and proxy services in your on-premises environment.
+
+**Remediation action**
+- [Plan and deploy on-premises Azure Active Directory Password Protection](https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy)
+- [Enable on-premises Azure Active Directory Password Protection](https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-operations)
+- [Monitor on-premises Azure Active Directory Password Protection](https://learn.microsoft.com/entra/identity/authentication/howto-password-ban-bad-on-premises-monitor)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR02.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR02.ps1
new file mode 100644
index 000000000000..201e4d78f156
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR02.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCAPR02 {
+    <#
+    .SYNOPSIS
+    Password Rule Settings - Enable password protection on Windows Server Active Directory
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR02' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Password Rule Settings - Enable password protection on Windows Server Active Directory' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Password Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'EnableBannedPasswordCheckOnPremises' }).value
+
+        if ($SettingValue -eq 'True') {
+            $Status = 'Passed'
+            $Result = 'Password protection is enabled for on-premises Active Directory'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Password protection should be enabled for on-premises Active Directory to prevent weak passwords.
+
+**Current Configuration:**
+- EnableBannedPasswordCheckOnPremises: $SettingValue
+
+**Recommended Configuration:**
+- EnableBannedPasswordCheckOnPremises: True
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR02' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Password Rule Settings - Enable password protection on Windows Server Active Directory' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Password Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR02' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Password Rule Settings - Enable password protection on Windows Server Active Directory' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Password Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR03.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR03.md
new file mode 100644
index 000000000000..604afe21a263
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR03.md
@@ -0,0 +1,13 @@
+# Password Rule Settings - Enforce custom list
+
+A custom banned password list should be enforced to block passwords that are specific to your organization, such as company names, product names, locations, or industry-specific terms that attackers might use in targeted password attacks.
+
+The custom banned password list complements Microsoft's global banned password list to provide organization-specific protection against weak passwords. This helps prevent users from choosing passwords that may be easily guessed based on knowledge of your organization.
+
+**Remediation action**
+- [Configure custom banned password list](https://learn.microsoft.com/entra/identity/authentication/tutorial-configure-custom-password-protection)
+- [Eliminate bad passwords using Azure Active Directory Password Protection](https://learn.microsoft.com/entra/identity/authentication/concept-password-ban-bad)
+- [Password policies and account restrictions in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-password-policies)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR03.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR03.ps1
new file mode 100644
index 000000000000..4efd63038aec
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR03.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCAPR03 {
+    <#
+    .SYNOPSIS
+    Password Rule Settings - Enforce custom list
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR03' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Password Rule Settings - Enforce custom list' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'EnableBannedPasswordCheck' }).value
+
+        if ($SettingValue -eq 'True') {
+            $Status = 'Passed'
+            $Result = 'Custom banned password list is enforced'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Custom banned password list should be enforced to prevent common weak passwords.
+
+**Current Configuration:**
+- EnableBannedPasswordCheck: $SettingValue
+
+**Recommended Configuration:**
+- EnableBannedPasswordCheck: True
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR03' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Password Rule Settings - Enforce custom list' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR03' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Password Rule Settings - Enforce custom list' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR05.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR05.md
new file mode 100644
index 000000000000..96657ca3c744
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR05.md
@@ -0,0 +1,13 @@
+# Password Rule Settings - Lockout duration in seconds
+
+Account lockout duration should be configured to automatically unlock accounts after a specified period following too many failed sign-in attempts. A recommended lockout duration is at least 60 seconds to slow down brute-force attacks while balancing user convenience and security.
+
+The lockout duration determines how long an account remains locked after reaching the lockout threshold, providing temporary protection against automated password guessing attacks.
+
+**Remediation action**
+- [Microsoft Entra smart lockout](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout)
+- [Password policies and account restrictions in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-password-policies)
+- [Configure smart lockout thresholds](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout#configure-smart-lockout)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR05.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR05.ps1
new file mode 100644
index 000000000000..f711d13880f5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR05.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCAPR05 {
+    <#
+    .SYNOPSIS
+    Password Rule Settings - Lockout duration in seconds
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR05' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Password Rule Settings - Lockout duration in seconds' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'LockoutDurationInSeconds' }).value
+
+        if ([int]$SettingValue -ge 60) {
+            $Status = 'Passed'
+            $Result = "Lockout duration is set to $SettingValue seconds (minimum 60 seconds required)"
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Lockout duration should be at least 60 seconds to protect against brute force attacks.
+
+**Current Configuration:**
+- LockoutDurationInSeconds: $SettingValue
+
+**Recommended Configuration:**
+- LockoutDurationInSeconds: 60 or greater
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR05' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Password Rule Settings - Lockout duration in seconds' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR05' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Password Rule Settings - Lockout duration in seconds' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR06.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR06.md
new file mode 100644
index 000000000000..c98e68b5d05e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR06.md
@@ -0,0 +1,13 @@
+# Password Rule Settings - Lockout threshold
+
+A lockout threshold should be configured to prevent brute-force password attacks by temporarily locking accounts after a specified number of failed sign-in attempts. A recommended threshold is 10 or fewer failed attempts, which provides strong protection against automated attacks while minimizing the impact on legitimate users who may occasionally mistype their passwords.
+
+Smart lockout in Microsoft Entra ID uses machine learning to distinguish between legitimate users and attackers, helping to prevent legitimate users from being locked out while still protecting against malicious sign-in attempts.
+
+**Remediation action**
+- [Microsoft Entra smart lockout](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout)
+- [Password policies and account restrictions in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/concept-password-policies)
+- [Protect user accounts from attacks with Microsoft Entra ID Protection](https://learn.microsoft.com/entra/id-protection/overview-identity-protection)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR06.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR06.ps1
new file mode 100644
index 000000000000..24c2de9781d5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAPR06.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCAPR06 {
+    <#
+    .SYNOPSIS
+    Password Rule Settings - Lockout threshold
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR06' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Password Rule Settings - Lockout threshold' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'LockoutThreshold' }).value
+
+        if ([int]$SettingValue -le 10) {
+            $Status = 'Passed'
+            $Result = "Lockout threshold is set to $SettingValue failed attempts (maximum 10 attempts recommended)"
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Lockout threshold should be 10 or fewer failed attempts to protect against brute force attacks.
+
+**Current Configuration:**
+- LockoutThreshold: $SettingValue
+
+**Recommended Configuration:**
+- LockoutThreshold: 10 or fewer
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR06' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Password Rule Settings - Lockout threshold' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAPR06' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Password Rule Settings - Lockout threshold' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Password Policy'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST08.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST08.md
new file mode 100644
index 000000000000..861f4980d274
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST08.md
@@ -0,0 +1,13 @@
+# Classification and M365 Groups - Allow Guests to become Group Owner
+
+Guest users should not be allowed to become group owners to maintain proper access control and governance over Microsoft 365 groups and teams. Group owners have significant privileges including the ability to add or remove members, modify group settings, and control access to group resources.
+
+Allowing guests to become group owners creates security risks as external users could potentially grant unauthorized access to organizational resources or modify group configurations in ways that conflict with organizational policies.
+
+**Remediation action**
+- [Manage guest access in Microsoft 365 groups](https://learn.microsoft.com/microsoft-365/admin/create-groups/manage-guest-access-in-groups)
+- [Microsoft 365 groups and Microsoft Entra access](https://learn.microsoft.com/entra/identity/users/groups-settings-v2-cmdlets)
+- [Review and manage guest user access](https://learn.microsoft.com/entra/identity/users/users-restrict-guest-permissions)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST08.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST08.ps1
new file mode 100644
index 000000000000..eb362a64c07b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST08.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCAST08 {
+    <#
+    .SYNOPSIS
+    Classification and M365 Groups - Allow Guests to become Group Owner
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAST08' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Classification and M365 Groups - Allow Guests to become Group Owner' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Group Settings'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'AllowGuestsToBeGroupOwner' }).value
+
+        if ($SettingValue -eq 'false') {
+            $Status = 'Passed'
+            $Result = 'Guests are not allowed to become group owners'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Guests should not be allowed to become group owners to maintain proper access control.
+
+**Current Configuration:**
+- AllowGuestsToBeGroupOwner: $SettingValue
+
+**Recommended Configuration:**
+- AllowGuestsToBeGroupOwner: false
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAST08' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Classification and M365 Groups - Allow Guests to become Group Owner' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Group Settings'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAST08' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Classification and M365 Groups - Allow Guests to become Group Owner' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Group Settings'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST09.md b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST09.md
new file mode 100644
index 000000000000..35def764040b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST09.md
@@ -0,0 +1,13 @@
+# Classification and M365 Groups - Allow Guests to have access to groups content
+
+Guest access to Microsoft 365 groups content should be carefully controlled based on your organization's collaboration requirements and security policies. When enabled, guests can access group resources including SharePoint sites, Teams content, and group files. However, organizations should assess whether guest access is necessary and implement appropriate controls.
+
+Consider your organization's collaboration needs and data sensitivity when configuring this setting. For highly secure environments, disabling guest access may be appropriate, while collaboration-focused organizations may enable it with proper oversight.
+
+**Remediation action**
+- [Manage guest access in Microsoft 365 groups](https://learn.microsoft.com/microsoft-365/admin/create-groups/manage-guest-access-in-groups)
+- [Configure external collaboration settings](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure)
+- [Secure collaboration with Microsoft 365](https://learn.microsoft.com/microsoft-365/solutions/setup-secure-collaboration-with-teams)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST09.ps1 b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST09.ps1
new file mode 100644
index 000000000000..161a8ce28821
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAST09.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestEIDSCAST09 {
+    <#
+    .SYNOPSIS
+    Classification and M365 Groups - Allow Guests to have access to groups content
+    #>
+    param($Tenant)
+
+    try {
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAST09' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Classification and M365 Groups - Allow Guests to have access to groups content' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Group Settings'
+            return
+        }
+
+        $SettingValue = ($Settings.values | Where-Object { $_.name -eq 'AllowGuestsToAccessGroups' }).value
+
+        if ($SettingValue -eq 'True') {
+            $Status = 'Passed'
+            $Result = 'Guests are allowed to access groups content'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Guests should be allowed to access groups content for proper collaboration.
+
+**Current Configuration:**
+- AllowGuestsToAccessGroups: $SettingValue
+
+**Recommended Configuration:**
+- AllowGuestsToAccessGroups: True
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAST09' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Classification and M365 Groups - Allow Guests to have access to groups content' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Group Settings'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'EIDSCAST09' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Classification and M365 Groups - Allow Guests to have access to groups content' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Group Settings'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/EIDSCA/report.json b/Modules/CIPPCore/Public/Tests/EIDSCA/report.json
new file mode 100644
index 000000000000..0db980ceada1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/EIDSCA/report.json
@@ -0,0 +1,53 @@
+{
+  "name": "EIDSCA (Entra ID Security Configuration Analyzer) Tests",
+  "description": "Comprehensive security assessment for Microsoft Entra ID (formerly Azure AD) covering authorization policies, authentication methods, consent policies, password policies, and group settings. Based on Microsoft's EIDSCA framework for identity security best practices.",
+  "version": "1.0",
+  "source": "https://github.com/maester365/maester",
+  "category": "Identity Security",
+  "IdentityTests": [
+    "EIDSCAAP01",
+    "EIDSCAAP04",
+    "EIDSCAAP05",
+    "EIDSCAAP06",
+    "EIDSCAAP07",
+    "EIDSCAAP08",
+    "EIDSCAAP09",
+    "EIDSCAAP10",
+    "EIDSCAAP14",
+    "EIDSCACP01",
+    "EIDSCACP03",
+    "EIDSCACP04",
+    "EIDSCAPR01",
+    "EIDSCAPR02",
+    "EIDSCAPR03",
+    "EIDSCAPR05",
+    "EIDSCAPR06",
+    "EIDSCAST08",
+    "EIDSCAST09",
+    "EIDSCAAG01",
+    "EIDSCAAG02",
+    "EIDSCAAG03",
+    "EIDSCAAM01",
+    "EIDSCAAM02",
+    "EIDSCAAM03",
+    "EIDSCAAM04",
+    "EIDSCAAM06",
+    "EIDSCAAM07",
+    "EIDSCAAM09",
+    "EIDSCAAM10",
+    "EIDSCAAF01",
+    "EIDSCAAF02",
+    "EIDSCAAF03",
+    "EIDSCAAF04",
+    "EIDSCAAF05",
+    "EIDSCAAF06",
+    "EIDSCAAT01",
+    "EIDSCAAT02",
+    "EIDSCAAV01",
+    "EIDSCAAS04",
+    "EIDSCACR01",
+    "EIDSCACR02",
+    "EIDSCACR03",
+    "EIDSCACR04"
+  ]
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA100.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA100.md
new file mode 100644
index 000000000000..55f82ea10817
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA100.md
@@ -0,0 +1,8 @@
+The Bulk Complaint Level (BCL) threshold determines when bulk email messages are treated as spam. Microsoft recommends setting this value between 4 and 6 to achieve a balance between spam protection and minimizing false positives. A threshold that is too high may allow bulk spam through, while one that is too low may quarantine legitimate bulk email.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Bulk Complaint Level (BCL) in Exchange Online Protection](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-bulk-complaint-level-bcl-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA100.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA100.ps1
new file mode 100644
index 000000000000..b6f56d3aec61
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA100.ps1
@@ -0,0 +1,50 @@
+function Invoke-CippTestORCA100 {
+    <#
+    .SYNOPSIS
+    Bulk Complaint Level threshold is between 4 and 6
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA100' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Bulk Complaint Level threshold is between 4 and 6' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            # Check if BulkThreshold is between 4 and 6 (inclusive)
+            if ($Policy.BulkThreshold -ge 4 -and $Policy.BulkThreshold -le 6) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have appropriate Bulk Complaint Level (BCL) thresholds set between 4 and 6.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies have BCL thresholds outside the recommended range (4-6).`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Current BCL Threshold |`n"
+            $Result += "|------------|----------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.BulkThreshold) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA100' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Bulk Complaint Level threshold is between 4 and 6' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA100' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Bulk Complaint Level threshold is between 4 and 6' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA101.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA101.md
new file mode 100644
index 000000000000..6b67729768d4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA101.md
@@ -0,0 +1,8 @@
+Anti-spam policies should enable the option to move spam messages to the Junk Email folder rather than deleting them. This provides users with visibility into what was filtered and allows them to review messages that may have been incorrectly classified, reducing the risk of lost legitimate emails.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA101.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA101.ps1
new file mode 100644
index 000000000000..69ec5003be84
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA101.ps1
@@ -0,0 +1,56 @@
+function Invoke-CippTestORCA101 {
+    <#
+    .SYNOPSIS
+    Bulk is marked as spam
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA101' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Bulk is marked as spam' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.MarkAsSpamBulkMail -eq 'On') {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies are configured to mark bulk mail as spam.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)`n`n"
+            if ($PassedPolicies.Count -gt 0) {
+                $Result += "| Policy Name | Mark As Spam Bulk Mail |`n"
+                $Result += "|------------|------------------------|`n"
+                foreach ($Policy in $PassedPolicies) {
+                    $Result += "| $($Policy.Identity) | $($Policy.MarkAsSpamBulkMail) |`n"
+                }
+            }
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies are not configured to mark bulk mail as spam.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Mark As Spam Bulk Mail |`n"
+            $Result += "|------------|------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.MarkAsSpamBulkMail) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA101' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Bulk is marked as spam' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA101' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Bulk is marked as spam' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.md
new file mode 100644
index 000000000000..4675fbf0fed5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.md
@@ -0,0 +1,8 @@
+Advanced Spam Filtering (ASF) options in anti-spam policies provide additional protection against spam. However, Microsoft recommends disabling most ASF options as they can cause false positives. Standard filtering with Defender for Office 365 is more effective. Only specific ASF options should remain enabled when needed for legacy protection scenarios.
+
+**Remediation action**
+
+- [Advanced Spam Filter (ASF) settings in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-asf-settings-about)
+- [Configure anti-spam policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.ps1
new file mode 100644
index 000000000000..31da61d73746
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.ps1
@@ -0,0 +1,74 @@
+function Invoke-CippTestORCA102 {
+    <#
+    .SYNOPSIS
+    Advanced Spam filter options are turned off
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA102' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Advanced Spam filter options are turned off' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $ASFSettings = @(
+                $Policy.IncreaseScoreWithImageLinks,
+                $Policy.IncreaseScoreWithNumericIps,
+                $Policy.IncreaseScoreWithRedirectToOtherPort,
+                $Policy.IncreaseScoreWithBizOrInfoUrls,
+                $Policy.MarkAsSpamEmptyMessages,
+                $Policy.MarkAsSpamJavaScriptInHtml,
+                $Policy.MarkAsSpamFramesInHtml,
+                $Policy.MarkAsSpamObjectTagsInHtml,
+                $Policy.MarkAsSpamEmbedTagsInHtml,
+                $Policy.MarkAsSpamFormTagsInHtml,
+                $Policy.MarkAsSpamWebBugsInHtml,
+                $Policy.MarkAsSpamSensitiveWordList,
+                $Policy.MarkAsSpamFromAddressAuthFail,
+                $Policy.MarkAsSpamNdrBackscatter,
+                $Policy.MarkAsSpamSpfRecordHardFail
+            )
+
+            $EnabledASF = $ASFSettings | Where-Object { $_ -eq 'On' }
+
+            if ($EnabledASF.Count -eq 0) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have Advanced Spam Filter (ASF) options turned off.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies have Advanced Spam Filter (ASF) options enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enabled ASF Options |`n"
+            $Result += "|------------|---------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $EnabledOptions = [System.Collections.Generic.List[string]]::new()
+                if ($Policy.IncreaseScoreWithImageLinks -eq 'On') { $EnabledOptions.Add('ImageLinks') | Out-Null }
+                if ($Policy.IncreaseScoreWithNumericIps -eq 'On') { $EnabledOptions.Add('NumericIPs') | Out-Null }
+                if ($Policy.MarkAsSpamEmptyMessages -eq 'On') { $EnabledOptions.Add('EmptyMessages') | Out-Null }
+                if ($Policy.MarkAsSpamJavaScriptInHtml -eq 'On') { $EnabledOptions.Add('JavaScript') | Out-Null }
+                $Result += "| $($Policy.Identity) | $($EnabledOptions -join ', ') |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA102' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Advanced Spam filter options are turned off' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA102' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Advanced Spam filter options are turned off' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.md
new file mode 100644
index 000000000000..bc048fc4c32a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.md
@@ -0,0 +1,8 @@
+Outbound spam filter policies should be configured with appropriate limits to prevent compromised accounts from sending large volumes of spam. Microsoft recommends setting RecipientLimitExternalPerHour to 500, RecipientLimitInternalPerHour to 1000, and ActionWhenThresholdReached to BlockUserForToday to protect your organization's reputation and prevent abuse.
+
+**Remediation action**
+
+- [Configure outbound spam filtering](https://learn.microsoft.com/microsoft-365/security/office-365-security/outbound-spam-policies-configure)
+- [Outbound spam protection in Exchange Online](https://learn.microsoft.com/microsoft-365/security/office-365-security/outbound-spam-protection-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1
new file mode 100644
index 000000000000..10171890ecec
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1
@@ -0,0 +1,68 @@
+function Invoke-CippTestORCA103 {
+    <#
+    .SYNOPSIS
+    Outbound spam filter policy settings configured
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedOutboundSpamFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA103' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Outbound spam filter policy settings configured' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $IsCompliant = $true
+            $Issues = [System.Collections.Generic.List[string]]::new()
+
+            if ($Policy.RecipientLimitExternalPerHour -ne 500) {
+                $IsCompliant = $false
+                $Issues.Add("RecipientLimitExternalPerHour: $($Policy.RecipientLimitExternalPerHour) (should be 500)") | Out-Null
+            }
+            if ($Policy.RecipientLimitInternalPerHour -ne 1000) {
+                $IsCompliant = $false
+                $Issues.Add("RecipientLimitInternalPerHour: $($Policy.RecipientLimitInternalPerHour) (should be 1000)") | Out-Null
+            }
+            if ($Policy.ActionWhenThresholdReached -ne 'BlockUserForToday') {
+                $IsCompliant = $false
+                $Issues.Add("ActionWhenThresholdReached: $($Policy.ActionWhenThresholdReached) (should be BlockUserForToday)") | Out-Null
+            }
+
+            if ($IsCompliant) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add([PSCustomObject]@{
+                        Policy = $Policy
+                        Issues = $Issues
+                    }) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All outbound spam filter policies are configured correctly.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) outbound spam filter policies are not configured correctly.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Issues |`n"
+            $Result += "|------------|--------|`n"
+            foreach ($Failed in $FailedPolicies) {
+                $Result += "| $($Failed.Policy.Identity) | $($Failed.Issues -join '<br/>') |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA103' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Outbound spam filter policy settings configured' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+        } catch {
+            $ErrorMessage = Get-CippException -Exception $_
+            Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA103' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Outbound spam filter policy settings configured' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+        }
+    }
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.md
new file mode 100644
index 000000000000..bf7bb5221b01
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.md
@@ -0,0 +1,10 @@
+Anti-phishing policies should have High Confidence Phish action set to Quarantine to protect users from sophisticated phishing attacks. Messages identified as high-confidence phishing attempts pose a significant security risk and should be quarantined for review rather than delivered to users.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about)
+- [Set up anti-phishing policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.ps1
new file mode 100644
index 000000000000..5f49f7072020
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.ps1
@@ -0,0 +1,58 @@
+function Invoke-CippTestORCA104 {
+    <#
+    .SYNOPSIS
+    High Confidence Phish action set to Quarantine message
+    #>
+    param($Tenant)
+
+    try {
+        $AntiPhishPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $AntiPhishPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA104' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'High Confidence Phish action set to Quarantine message' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = @()
+        $PassedPolicies = @()
+
+        foreach ($Policy in $AntiPhishPolicies) {
+            # Check if HighConfidencePhishAction is set to Quarantine
+            if ($Policy.HighConfidencePhishAction -eq 'Quarantine') {
+                $PassedPolicies += $Policy
+            } else {
+                $FailedPolicies += $Policy
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have High Confidence Phish action set to Quarantine.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)`n`n"
+            if ($PassedPolicies.Count -gt 0) {
+                $Result += "| Policy Name | Action |`n"
+                $Result += "|------------|--------|`n"
+                foreach ($Policy in $PassedPolicies) {
+                    $Result += "| $($Policy.Identity) | $($Policy.HighConfidencePhishAction) |`n"
+                }
+            }
+        } else {
+            $Status = 'Failed'
+            $Result = "Some anti-phishing policies do not have High Confidence Phish action set to Quarantine.`n`n"
+            $Result += "**Failed Policies:** $($FailedPolicies.Count) | **Passed Policies:** $($PassedPolicies.Count)`n`n"
+            $Result += "### Non-Compliant Policies`n`n"
+            $Result += "| Policy Name | Current Action | Recommended Action |`n"
+            $Result += "|------------|----------------|-------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.HighConfidencePhishAction) | Quarantine |`n"
+            }
+            $Result += "`n**Remediation:** Update the HighConfidencePhishAction to 'Quarantine' for enhanced security."
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA104' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'High Confidence Phish action set to Quarantine message' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA104' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'High Confidence Phish action set to Quarantine message' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA105.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA105.md
new file mode 100644
index 000000000000..3391a38cece9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA105.md
@@ -0,0 +1,10 @@
+Safe Links policies should enable synchronous URL detonation (DeliverMessageAfterScan) to scan links in real-time before delivering messages to users. This ensures that malicious URLs are detected and blocked before they reach user mailboxes, providing enhanced protection against zero-day attacks and sophisticated phishing campaigns.
+
+**Remediation action**
+
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA105.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA105.ps1
new file mode 100644
index 000000000000..84d4a6dd7ab4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA105.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA105 {
+    <#
+    .SYNOPSIS
+    Safe Links Synchronous URL detonation is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA105' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe Links Synchronous URL detonation is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.DeliverMessageAfterScan -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Links policies have synchronous URL detonation enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) Safe Links policies do not have synchronous URL detonation enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Deliver Message After Scan |`n"
+            $Result += "|------------|---------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.DeliverMessageAfterScan) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA105' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe Links Synchronous URL detonation is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA105' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe Links Synchronous URL detonation is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA106.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA106.md
new file mode 100644
index 000000000000..8955503864dd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA106.md
@@ -0,0 +1,10 @@
+Anti-spam policies should have a quarantine retention period of at least 30 days to allow sufficient time for administrators to review and release legitimate messages that were incorrectly quarantined. A retention period that is too short may result in legitimate messages being permanently deleted before they can be reviewed.
+
+**Remediation action**
+
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Anti-spam protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-protection-about)
+- [Quarantine policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/quarantine-policies)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA106.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA106.ps1
new file mode 100644
index 000000000000..2058a76fb616
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA106.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA106 {
+    <#
+    .SYNOPSIS
+    Quarantine retention period is 30 days
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA106' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Quarantine retention period is 30 days' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.QuarantineRetentionPeriod -gt 15) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have quarantine retention period set to 30 days.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have quarantine retention period set to 30 days.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Quarantine Retention Period |`n"
+            $Result += "|------------|----------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.QuarantineRetentionPeriod) days |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA106' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Quarantine retention period is 30 days' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA106' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Quarantine retention period is 30 days' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.md
new file mode 100644
index 000000000000..6c0f3601b410
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.md
@@ -0,0 +1,10 @@
+Quarantine policies should enable end-user spam notifications to inform users about messages that have been quarantined. This allows users to review and release legitimate messages that may have been incorrectly identified as spam, reducing administrative overhead and improving user experience.
+
+**Remediation action**
+
+- [Quarantine policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/quarantine-policies)
+- [End-user spam notifications in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/quarantine-end-user)
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1
new file mode 100644
index 000000000000..51f4a1a90e95
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1
@@ -0,0 +1,57 @@
+function Invoke-CippTestORCA107 {
+    <#
+    .SYNOPSIS
+    End-user spam notification is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoQuarantinePolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA107' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'End-user spam notification is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Quarantine'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EndUserSpamNotificationFrequency -gt 0) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0 -and $PassedPolicies.Count -gt 0) {
+            $Status = 'Passed'
+            $Result = "All quarantine policies have end-user spam notifications enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Notification Frequency (days) |`n"
+            $Result += "|------------|-------------------------------|`n"
+            foreach ($Policy in $PassedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EndUserSpamNotificationFrequency) |`n"
+            }
+        } elseif ($PassedPolicies.Count -eq 0) {
+            $Status = 'Failed'
+            $Result = "No quarantine policies have end-user spam notifications enabled.`n`n"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) quarantine policies do not have end-user spam notifications enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Notification Frequency |`n"
+            $Result += "|------------|----------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | Disabled |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA107' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'End-user spam notification is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Quarantine'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA107' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'End-user spam notification is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Quarantine'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108.md
new file mode 100644
index 000000000000..4539f91ff893
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108.md
@@ -0,0 +1,10 @@
+DKIM (DomainKeys Identified Mail) signing should be enabled for all custom domains in your organization. DKIM adds a digital signature to outbound email messages, allowing receiving mail servers to verify that the message was sent from your domain and hasn't been altered in transit. This helps prevent email spoofing and improves email deliverability.
+
+**Remediation action**
+
+- [Use DKIM to validate outbound email sent from your custom domain](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-dkim-configure)
+- [How Microsoft 365 uses SPF and DKIM to prevent spoofing](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-anti-spoofing)
+- [Email authentication in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-about)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108.ps1
new file mode 100644
index 000000000000..390ab97aa9aa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108.ps1
@@ -0,0 +1,61 @@
+function Invoke-CippTestORCA108 {
+    <#
+    .SYNOPSIS
+    DKIM signing is set up for all your custom domains
+    #>
+    param($Tenant)
+
+    try {
+        $DkimConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoDkimSigningConfig'
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $DkimConfig -or -not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA108' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'DKIM signing is set up for all your custom domains' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'DKIM'
+            return
+        }
+
+        # Get custom domains (exclude default .onmicrosoft.com domains)
+        $CustomDomains = $AcceptedDomains | Where-Object {
+            $_.DomainName -notlike '*.onmicrosoft.com' -and
+            $_.DomainName -notlike '*.mail.onmicrosoft.com'
+        }
+
+        if ($CustomDomains.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = 'No custom domains configured. DKIM check not applicable for default domains only.'
+        } else {
+            $DomainsWithoutDkim = @()
+            $DomainsWithDkim = @()
+
+            foreach ($Domain in $CustomDomains) {
+                $DkimForDomain = $DkimConfig | Where-Object { $_.Domain -eq $Domain.DomainName }
+
+                if ($DkimForDomain -and $DkimForDomain.Enabled -eq $true) {
+                    $DomainsWithDkim += $Domain.DomainName
+                } else {
+                    $DomainsWithoutDkim += $Domain.DomainName
+                }
+            }
+
+            if ($DomainsWithoutDkim.Count -eq 0) {
+                $Status = 'Passed'
+                $Result = "DKIM signing is enabled for all custom domains ($($DomainsWithDkim.Count) domains).`n`n"
+                $Result += "**Domains with DKIM enabled:**`n"
+                $Result += ($DomainsWithDkim | ForEach-Object { "- $_" }) -join "`n"
+            } else {
+                $Status = 'Failed'
+                $Result = "DKIM signing is not configured for all custom domains.`n`n"
+                $Result += "**Missing DKIM:** $($DomainsWithoutDkim.Count) | **Configured:** $($DomainsWithDkim.Count)`n`n"
+                $Result += "### Domains without DKIM:`n"
+                $Result += ($DomainsWithoutDkim | ForEach-Object { "- $_" }) -join "`n"
+                $Result += "`n`n**Remediation:** Enable DKIM signing for all custom domains to prevent email spoofing."
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA108' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'DKIM signing is set up for all your custom domains' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'DKIM'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA108' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'DKIM signing is set up for all your custom domains' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'DKIM'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108_1.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108_1.md
new file mode 100644
index 000000000000..907ad5c4e661
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108_1.md
@@ -0,0 +1,9 @@
+DNS records must be properly configured to support DKIM signing for your custom domains. After enabling DKIM in Microsoft 365, you need to publish the DKIM CNAME records in your domain's DNS zone. Without these DNS records, DKIM signing will not function properly, and your outbound emails will not be signed.
+
+**Remediation action**
+
+- [Use DKIM to validate outbound email sent from your custom domain](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-dkim-configure)
+- [Steps to create, enable and disable DKIM from Microsoft 365 Defender portal](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-dkim-configure#steps-to-create-enable-and-disable-dkim-from-microsoft-365-defender-portal)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108_1.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108_1.ps1
new file mode 100644
index 000000000000..6d39c4e1d476
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA108_1.ps1
@@ -0,0 +1,53 @@
+function Invoke-CippTestORCA108_1 {
+    <#
+    .SYNOPSIS
+    DNS Records have been set up to support DKIM
+    #>
+    param($Tenant)
+
+    try {
+        $DkimConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoDkimSigningConfig'
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $DkimConfig -or -not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA108_1' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'DNS Records have been set up to support DKIM' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'DKIM'
+            return
+        }
+
+        $FailedDomains = [System.Collections.Generic.List[object]]::new()
+        $PassedDomains = [System.Collections.Generic.List[object]]::new()
+        $CustomDomains = $AcceptedDomains | Where-Object { $_.DomainName -notlike '*onmicrosoft.com' }
+
+        foreach ($Domain in $CustomDomains) {
+            $DkimRecord = $DkimConfig | Where-Object { $_.Domain -eq $Domain.DomainName }
+
+            if ($DkimRecord -and $DkimRecord.Selector1CNAME -and $DkimRecord.Selector2CNAME) {
+                $PassedDomains.Add($Domain) | Out-Null
+            } else {
+                $FailedDomains.Add($Domain) | Out-Null
+            }
+        }
+
+        if ($FailedDomains.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All custom domains have DKIM DNS records configured.`n`n"
+            $Result += "**Compliant Domains:** $($PassedDomains.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedDomains.Count) custom domains do not have DKIM DNS records configured.`n`n"
+            $Result += "**Non-Compliant Domains:** $($FailedDomains.Count)`n`n"
+            $Result += "| Domain Name |`n"
+            $Result += "|------------|`n"
+            foreach ($Domain in $FailedDomains) {
+                $Result += "| $($Domain.DomainName) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA108_1' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'DNS Records have been set up to support DKIM' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'DKIM'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA108_1' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'DNS Records have been set up to support DKIM' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'DKIM'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA109.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA109.md
new file mode 100644
index 000000000000..b4fb18706c7f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA109.md
@@ -0,0 +1,10 @@
+Anti-spam policies should not have senders or domains configured in the allow list in an unsafe manner. Allowing senders or entire domains to bypass spam filtering can expose your organization to phishing attacks and malware. Allow lists should be used sparingly and only for trusted senders with a verified business relationship.
+
+**Remediation action**
+
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Create safe sender lists in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365)
+- [Use mail flow rules to filter bulk email in Exchange Online](https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/use-rules-to-filter-bulk-mail)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA109.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA109.ps1
new file mode 100644
index 000000000000..45bbfc43b14d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA109.ps1
@@ -0,0 +1,54 @@
+function Invoke-CippTestORCA109 {
+    <#
+    .SYNOPSIS
+    Senders are not being allow listed in an unsafe manner
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA109' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Senders are not being allow listed in an unsafe manner' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $HasAllowedSenders = ($Policy.AllowedSenders -and $Policy.AllowedSenders.Count -gt 0) -or
+            ($Policy.AllowedSenderDomains -and $Policy.AllowedSenderDomains.Count -gt 0)
+
+            if (-not $HasAllowedSenders) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No anti-spam policies have sender allow lists configured.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies have sender allow lists configured.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Allowed Senders | Allowed Sender Domains |`n"
+            $Result += "|------------|----------------|----------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $SenderCount = if ($Policy.AllowedSenders) { $Policy.AllowedSenders.Count } else { 0 }
+                $DomainCount = if ($Policy.AllowedSenderDomains) { $Policy.AllowedSenderDomains.Count } else { 0 }
+                $Result += "| $($Policy.Identity) | $SenderCount | $DomainCount |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA109' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Senders are not being allow listed in an unsafe manner' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA109' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Senders are not being allow listed in an unsafe manner' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA110.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA110.md
new file mode 100644
index 000000000000..70a3607e6be1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA110.md
@@ -0,0 +1,10 @@
+Anti-spam policies should have internal sender notifications disabled to prevent information disclosure. Notifying internal senders when their messages are quarantined can reveal security policy details to potentially compromised accounts and may be used by attackers to understand and bypass your security measures.
+
+**Remediation action**
+
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Anti-spam protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-protection-about)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA110.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA110.ps1
new file mode 100644
index 000000000000..1894ebd339d7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA110.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA110 {
+    <#
+    .SYNOPSIS
+    Internal Sender notifications are disabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA110' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Internal Sender notifications are disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.InlineSafetyTipsEnabled -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have internal sender notifications disabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies have internal sender notifications enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Inline Safety Tips Enabled |`n"
+            $Result += "|------------|---------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.InlineSafetyTipsEnabled) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA110' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Internal Sender notifications are disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA110' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Internal Sender notifications are disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA111.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA111.md
new file mode 100644
index 000000000000..36010802db16
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA111.md
@@ -0,0 +1,10 @@
+Anti-phishing policies should enable the unauthenticated sender indicator (EnableUnauthenticatedSender) to display a visual indicator for messages that fail authentication checks. This helps users identify potentially spoofed messages and reduces the risk of falling victim to phishing attacks.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about)
+- [Set up anti-phishing policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Unauthenticated sender indicators](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about#unauthenticated-sender-indicators)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA111.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA111.ps1
new file mode 100644
index 000000000000..1fa78226d75b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA111.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA111 {
+    <#
+    .SYNOPSIS
+    Anti-phishing policy exists and EnableUnauthenticatedSender is true
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA111' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Unauthenticated Sender tagging enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableUnauthenticatedSender -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have unauthenticated sender tagging enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have unauthenticated sender tagging enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Unauthenticated Sender |`n"
+            $Result += "|------------|------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableUnauthenticatedSender) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA111' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Unauthenticated Sender tagging enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA111' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Unauthenticated Sender tagging enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA112.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA112.md
new file mode 100644
index 000000000000..fb0bf7059686
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA112.md
@@ -0,0 +1,10 @@
+Anti-phishing policies should configure the anti-spoofing protection action to move messages to the Junk Email folder. This provides protection against spoofed messages while allowing users to review them if needed. Messages that appear to be from internal senders but fail authentication checks should be quarantined to prevent impersonation attacks.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about)
+- [Spoof intelligence insight in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spoofing-spoof-intelligence)
+- [Anti-spoofing protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection-spoofing-about)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA112.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA112.ps1
new file mode 100644
index 000000000000..84761e1e4d29
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA112.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA112 {
+    <#
+    .SYNOPSIS
+    Anti-spoofing protection action is configured to Move message to Junk Email folders
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA112' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Anti-spoofing protection action configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.AuthenticationFailAction -eq 'MoveToJmf') {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have anti-spoofing action set to Move to Junk Email folder.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have anti-spoofing action set to Move to Junk Email folder.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Authentication Fail Action |`n"
+            $Result += "|------------|---------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.AuthenticationFailAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA112' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Anti-spoofing protection action configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA112' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Anti-spoofing protection action configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.md
new file mode 100644
index 000000000000..5730ae5bc2d9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.md
@@ -0,0 +1,10 @@
+Safe Links policies should disable the AllowClickThrough setting to prevent users from clicking through to potentially malicious URLs even after receiving a warning. When AllowClickThrough is enabled, users can bypass the Safe Links warning page and navigate to the original URL, which significantly reduces the effectiveness of Safe Links protection.
+
+**Remediation action**
+
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.ps1
new file mode 100644
index 000000000000..93cfc03f605a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.ps1
@@ -0,0 +1,58 @@
+function Invoke-CippTestORCA113 {
+    <#
+    .SYNOPSIS
+    AllowClickThrough is disabled in Safe Links policies
+    #>
+    param($Tenant)
+
+    try {
+        $SafeLinksPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $SafeLinksPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA113' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'AllowClickThrough is disabled in Safe Links policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $FailedPolicies = @()
+        $PassedPolicies = @()
+
+        foreach ($Policy in $SafeLinksPolicies) {
+            # Check if DoNotAllowClickThrough is set to true (which means AllowClickThrough is disabled)
+            if ($Policy.DoNotAllowClickThrough -eq $true) {
+                $PassedPolicies += $Policy
+            } else {
+                $FailedPolicies += $Policy
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Links policies have click-through disabled (DoNotAllowClickThrough = true).`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)`n`n"
+            if ($PassedPolicies.Count -gt 0) {
+                $Result += "| Policy Name | DoNotAllowClickThrough |`n"
+                $Result += "|------------|----------------------|`n"
+                foreach ($Policy in $PassedPolicies) {
+                    $Result += "| $($Policy.Identity) | $($Policy.DoNotAllowClickThrough) |`n"
+                }
+            }
+        } else {
+            $Status = 'Failed'
+            $Result = "Some Safe Links policies allow click-through, which reduces protection.`n`n"
+            $Result += "**Failed Policies:** $($FailedPolicies.Count) | **Passed Policies:** $($PassedPolicies.Count)`n`n"
+            $Result += "### Non-Compliant Policies`n`n"
+            $Result += "| Policy Name | DoNotAllowClickThrough | Recommended |`n"
+            $Result += "|------------|----------------------|-------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.DoNotAllowClickThrough) | true |`n"
+            }
+            $Result += "`n**Remediation:** Disable click-through (set DoNotAllowClickThrough to true) to prevent users from bypassing Safe Links protection."
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA113' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'AllowClickThrough is disabled in Safe Links policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA113' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'AllowClickThrough is disabled in Safe Links policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA114.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA114.md
new file mode 100644
index 000000000000..04bf5f2fbbeb
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA114.md
@@ -0,0 +1,10 @@
+Anti-spam policies should not have IP addresses configured in the allow list. IP-based allow lists can be exploited by attackers who use compromised or shared infrastructure, and they bypass important security controls. Instead of using IP allow lists, implement proper email authentication (SPF, DKIM, DMARC) and use sender-based allow lists only when absolutely necessary.
+
+**Remediation action**
+
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Configure the connection filter policy](https://learn.microsoft.com/microsoft-365/security/office-365-security/connection-filter-policies-configure)
+- [Create safe sender lists in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA114.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA114.ps1
new file mode 100644
index 000000000000..bcafb040cb04
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA114.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestORCA114 {
+    <#
+    .SYNOPSIS
+    No IP Allow Lists have been configured
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA114' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'No IP Allow Lists have been configured' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+$FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $HasIPAllowList = ($Policy.IPAllowList -and $Policy.IPAllowList.Count -gt 0)
+
+            if (-not $HasIPAllowList) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No anti-spam policies have IP allow lists configured.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies have IP allow lists configured.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | IP Allow List Count |`n"
+            $Result += "|------------|-------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $IPCount = if ($Policy.IPAllowList) { $Policy.IPAllowList.Count } else { 0 }
+                $Result += "| $($Policy.Identity) | $IPCount |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA114' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'No IP Allow Lists have been configured' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA114' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'No IP Allow Lists have been configured' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA115.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA115.md
new file mode 100644
index 000000000000..a0485c090e97
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA115.md
@@ -0,0 +1,10 @@
+Anti-phishing policies should enable mailbox intelligence-based impersonation protection to leverage machine learning and user behavior patterns for detecting impersonation attempts. This feature analyzes email communication patterns and identifies messages that may be attempting to impersonate trusted contacts or business partners.
+
+**Remediation action**
+
+- [Impersonation settings in anti-phishing policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA115.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA115.ps1
new file mode 100644
index 000000000000..6c9e383ca1d8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA115.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA115 {
+    <#
+    .SYNOPSIS
+    Mailbox intelligence based impersonation protection is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA115' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Mailbox intelligence based impersonation protection is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableMailboxIntelligenceProtection -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have mailbox intelligence based impersonation protection enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have mailbox intelligence based impersonation protection enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Mailbox Intelligence Protection |`n"
+            $Result += "|------------|---------------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableMailboxIntelligenceProtection) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA115' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Mailbox intelligence based impersonation protection is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA115' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Mailbox intelligence based impersonation protection is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA116.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA116.md
new file mode 100644
index 000000000000..87a80c2c206e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA116.md
@@ -0,0 +1,10 @@
+Anti-phishing policies should configure mailbox intelligence-based impersonation protection to move messages to the Junk Email folder. This setting ensures that messages identified as potential impersonation attempts are quarantined or moved to junk mail, preventing users from being exposed to sophisticated social engineering attacks while still allowing for message review if needed.
+
+**Remediation action**
+
+- [Impersonation settings in anti-phishing policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA116.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA116.ps1
new file mode 100644
index 000000000000..3677473a0684
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA116.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA116 {
+    <#
+    .SYNOPSIS
+    Mailbox intelligence based impersonation protection action set to move message to junk mail folder
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA116' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Mailbox intelligence impersonation protection action configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.MailboxIntelligenceProtectionAction -eq 'MoveToJmf') {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have mailbox intelligence impersonation protection action set to Move to Junk Email folder.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have mailbox intelligence impersonation protection action set to Move to Junk Email folder.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Mailbox Intelligence Protection Action |`n"
+            $Result += "|------------|---------------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.MailboxIntelligenceProtectionAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA116' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Mailbox intelligence impersonation protection action configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA116' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Mailbox intelligence impersonation protection action configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_1.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_1.md
new file mode 100644
index 000000000000..eb778c08620e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_1.md
@@ -0,0 +1,10 @@
+Anti-spam policies should not have entire domains configured in the allow list. Allowing entire domains to bypass spam filtering can expose your organization to phishing attacks and malware, especially if the allowed domain is compromised or used by multiple organizations. Domain-based allow lists should be avoided, and sender-specific allow lists should be used sparingly only for verified business relationships.
+
+**Remediation action**
+
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Create safe sender lists in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/create-safe-sender-lists-in-office-365)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_1.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_1.ps1
new file mode 100644
index 000000000000..eadab025151c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_1.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestORCA118_1 {
+    <#
+    .SYNOPSIS
+    Domains not allow listed in Anti-Spam
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_1' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Domains not allow listed in Anti-Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $HasAllowedDomains = ($Policy.AllowedSenderDomains -and $Policy.AllowedSenderDomains.Count -gt 0)
+
+            if (-not $HasAllowedDomains) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No anti-spam policies have allowed sender domains configured.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies have allowed sender domains configured.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Allowed Sender Domains Count |`n"
+            $Result += "|------------|------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Count = if ($Policy.AllowedSenderDomains) { $Policy.AllowedSenderDomains.Count } else { 0 }
+                $Result += "| $($Policy.Identity) | $Count |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_1' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Domains not allow listed in Anti-Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_1' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Domains not allow listed in Anti-Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_2.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_2.md
new file mode 100644
index 000000000000..977cc4a452c8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_2.md
@@ -0,0 +1,10 @@
+Transport rules (mail flow rules) should not be configured to allow list entire domains and bypass spam filtering. Transport rules that skip spam filtering for entire domains can be exploited by attackers to deliver malicious content. These rules override anti-spam policies and should only be used in exceptional circumstances with strict conditions.
+
+**Remediation action**
+
+- [Mail flow rules (transport rules) in Exchange Online](https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)
+- [Use mail flow rules to inspect message attachments](https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/inspect-message-attachments)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_2.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_2.ps1
new file mode 100644
index 000000000000..15e795a6b9cf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_2.ps1
@@ -0,0 +1,48 @@
+function Invoke-CippTestORCA118_2 {
+    <#
+    .SYNOPSIS
+    Domains not allow listed in Transport Rules
+    #>
+    param($Tenant)
+
+    try {
+        $TransportRules = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoTransportRules'
+
+        if (-not $TransportRules) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_2' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Domains not allow listed in Transport Rules' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Transport Rules'
+            return
+        }
+
+        $FailedRules = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Rule in $TransportRules) {
+            # Check if rule sets SCL to -1 (bypass spam filtering) based on sender domain
+            if ($Rule.SetSCL -eq -1 -and $Rule.SenderDomainIs) {
+                $FailedRules.Add($Rule) | Out-Null
+            }
+        }
+
+        if ($FailedRules.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No transport rules allow list domains by setting SCL to -1.`n`n"
+            $Result += "**Total Transport Rules Checked:** $($TransportRules.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedRules.Count) transport rules allow list domains by setting SCL to -1.`n`n"
+            $Result += "**Non-Compliant Rules:** $($FailedRules.Count)`n`n"
+            $Result += "| Rule Name | Sender Domains |`n"
+            $Result += "|-----------|---------------|`n"
+            foreach ($Rule in $FailedRules) {
+                $Domains = if ($Rule.SenderDomainIs) { ($Rule.SenderDomainIs -join ', ') } else { 'N/A' }
+                $Result += "| $($Rule.Name) | $Domains |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_2' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Domains not allow listed in Transport Rules' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Transport Rules'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_2' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Domains not allow listed in Transport Rules' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Transport Rules'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_3.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_3.md
new file mode 100644
index 000000000000..77da8291faed
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_3.md
@@ -0,0 +1,10 @@
+Anti-spam policies should not have your organization's own domains configured in the allow list. Adding your own domains to the allow list can be exploited by attackers using spoofing techniques to bypass spam filtering. Internal domain protection should be handled through proper email authentication (SPF, DKIM, DMARC) and anti-spoofing policies, not through allow lists.
+
+**Remediation action**
+
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Anti-spoofing protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection-spoofing-about)
+- [Email authentication in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-about)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_3.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_3.ps1
new file mode 100644
index 000000000000..a01284c51be7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_3.ps1
@@ -0,0 +1,68 @@
+function Invoke-CippTestORCA118_3 {
+    <#
+    .SYNOPSIS
+    Own domains not allow listed in Anti-Spam
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_3' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Own domains not allow listed in Anti-Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_3' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Own domains not allow listed in Anti-Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $OwnDomains = $AcceptedDomains | Select-Object -ExpandProperty DomainName
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $HasOwnDomainInAllowList = $false
+
+            if ($Policy.AllowedSenderDomains) {
+                foreach ($AllowedDomain in $Policy.AllowedSenderDomains) {
+                    if ($OwnDomains -contains $AllowedDomain) {
+                        $HasOwnDomainInAllowList = $true
+                        break
+                    }
+                }
+            }
+
+            if ($HasOwnDomainInAllowList) {
+                $FailedPolicies.Add($Policy) | Out-Null
+            } else {
+                $PassedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No anti-spam policies have own domains in the allow list.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies have own domains in the allow list.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Own Domains in Allow List |`n"
+            $Result += "|------------|---------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $OwnDomainsInList = $Policy.AllowedSenderDomains | Where-Object { $OwnDomains -contains $_ }
+                $Result += "| $($Policy.Identity) | $($OwnDomainsInList -join ', ') |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_3' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Own domains not allow listed in Anti-Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_3' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Own domains not allow listed in Anti-Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_4.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_4.md
new file mode 100644
index 000000000000..a08348ebdb46
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_4.md
@@ -0,0 +1,10 @@
+Transport rules (mail flow rules) should not be configured to allow list your organization's own domains and bypass spam filtering. Allowing your own domains through transport rules can be exploited by attackers using spoofing techniques. These rules override important security controls and should never be used for internal domain protection.
+
+**Remediation action**
+
+- [Mail flow rules (transport rules) in Exchange Online](https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/mail-flow-rules)
+- [Anti-spoofing protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection-spoofing-about)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_4.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_4.ps1
new file mode 100644
index 000000000000..ace3850208a7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA118_4.ps1
@@ -0,0 +1,65 @@
+function Invoke-CippTestORCA118_4 {
+    <#
+    .SYNOPSIS
+    Own domains not allow listed in Transport Rules
+    #>
+    param($Tenant)
+
+    try {
+        $TransportRules = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoTransportRules'
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $TransportRules) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_4' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Own domains not allow listed in Transport Rules' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Transport Rules'
+            return
+        }
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_4' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Own domains not allow listed in Transport Rules' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Transport Rules'
+            return
+        }
+
+        $OwnDomains = $AcceptedDomains | Select-Object -ExpandProperty DomainName
+        $FailedRules = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Rule in $TransportRules) {
+            # Check if rule sets SCL to -1 (bypass spam filtering) based on sender domain
+            if ($Rule.SetSCL -eq -1 -and $Rule.SenderDomainIs) {
+                $HasOwnDomain = $false
+                foreach ($SenderDomain in $Rule.SenderDomainIs) {
+                    if ($OwnDomains -contains $SenderDomain) {
+                        $HasOwnDomain = $true
+                        break
+                    }
+                }
+
+                if ($HasOwnDomain) {
+                    $FailedRules.Add($Rule) | Out-Null
+                }
+            }
+        }
+
+        if ($FailedRules.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No transport rules allow list own domains by setting SCL to -1.`n`n"
+            $Result += "**Total Transport Rules Checked:** $($TransportRules.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedRules.Count) transport rules allow list own domains by setting SCL to -1.`n`n"
+            $Result += "**Non-Compliant Rules:** $($FailedRules.Count)`n`n"
+            $Result += "| Rule Name | Own Domains in Rule |`n"
+            $Result += "|-----------|-------------------|`n"
+            foreach ($Rule in $FailedRules) {
+                $OwnDomainsInRule = $Rule.SenderDomainIs | Where-Object { $OwnDomains -contains $_ }
+                $Result += "| $($Rule.Name) | $($OwnDomainsInRule -join ', ') |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_4' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Own domains not allow listed in Transport Rules' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Transport Rules'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA118_4' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Own domains not allow listed in Transport Rules' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Transport Rules'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA119.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA119.md
new file mode 100644
index 000000000000..9a7837fa85d0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA119.md
@@ -0,0 +1,10 @@
+Anti-phishing policies should enable similar domains safety tips to warn users when they receive messages from domains that are visually similar to known trusted domains. This feature helps protect users from homograph attacks and typosquatting attempts where attackers register domains that closely resemble legitimate domains to deceive users.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about)
+- [Safety tips in email messages](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection-about#safety-tips-in-email-messages)
+- [Set up anti-phishing policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA119.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA119.ps1
new file mode 100644
index 000000000000..8f8cbbca6ece
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA119.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA119 {
+    <#
+    .SYNOPSIS
+    Similar Domains Safety Tips is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -TestType 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA119' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Similar Domains Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableSimilarDomainsSafetyTips -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have Similar Domains Safety Tips enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have Similar Domains Safety Tips enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Similar Domains Safety Tips |`n"
+            $Result += "|------------|-----------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableSimilarDomainsSafetyTips) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA119' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Similar Domains Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA119' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Similar Domains Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_malware.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_malware.md
new file mode 100644
index 000000000000..e6170ac647d5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_malware.md
@@ -0,0 +1,10 @@
+Anti-malware policies should enable Zero Hour Autopurge (ZAP) for malware to automatically detect and remediate malicious messages that were delivered before the malware signature was available. ZAP for malware helps protect users from newly identified threats by removing or quarantining malicious messages from mailboxes after delivery.
+
+**Remediation action**
+
+- [Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge)
+- [Configure anti-malware policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-policies-configure)
+- [Anti-malware protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-protection-about)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_malware.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_malware.ps1
new file mode 100644
index 000000000000..360ddb3b97bd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_malware.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA120_malware {
+    <#
+    .SYNOPSIS
+    Zero Hour Autopurge Enabled for Malware
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_malware' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Malware' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Malware'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.ZapEnabled -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All malware filter policies have Zero Hour Autopurge enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) malware filter policies do not have Zero Hour Autopurge enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | ZAP Enabled |`n"
+            $Result += "|------------|------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.ZapEnabled) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_malware' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Malware' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Malware'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_malware' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Malware' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Malware'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_phish.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_phish.md
new file mode 100644
index 000000000000..4d588e4c685f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_phish.md
@@ -0,0 +1,10 @@
+Anti-spam policies should enable Zero Hour Autopurge (ZAP) for phishing messages to automatically detect and remediate phishing attacks that were delivered before they were identified as malicious. ZAP for phishing helps protect users from newly identified phishing campaigns by moving or deleting malicious messages from mailboxes after delivery.
+
+**Remediation action**
+
+- [Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge)
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Anti-spam protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-protection-about)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_phish.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_phish.ps1
new file mode 100644
index 000000000000..b13438033f14
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_phish.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA120_phish {
+    <#
+    .SYNOPSIS
+    Zero Hour Autopurge Enabled for Phish
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_phish' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Phish' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.PhishZapEnabled -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have Zero Hour Autopurge for Phish enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have Zero Hour Autopurge for Phish enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Phish ZAP Enabled |`n"
+            $Result += "|------------|------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.PhishZapEnabled) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_phish' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Phish' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_phish' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Phish' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_spam.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_spam.md
new file mode 100644
index 000000000000..3a972e8ceb97
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_spam.md
@@ -0,0 +1,10 @@
+Anti-spam policies should enable Zero Hour Autopurge (ZAP) for spam messages to automatically detect and move spam messages that were delivered before they were identified as spam. ZAP for spam helps keep user mailboxes clean by moving spam messages to the Junk Email folder after delivery, even if they initially passed spam filtering.
+
+**Remediation action**
+
+- [Zero-hour auto purge (ZAP) in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/zero-hour-auto-purge)
+- [Configure anti-spam policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Anti-spam protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-protection-about)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_spam.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_spam.ps1
new file mode 100644
index 000000000000..974c836d12e0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA120_spam.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA120_spam {
+    <#
+    .SYNOPSIS
+    Zero Hour Autopurge Enabled for Spam
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_spam' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.SpamZapEnabled -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have Zero Hour Autopurge for Spam enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have Zero Hour Autopurge for Spam enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Spam ZAP Enabled |`n"
+            $Result += "|------------|-----------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.SpamZapEnabled) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_spam' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA120_spam' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Zero Hour Autopurge Enabled for Spam' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA121.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA121.md
new file mode 100644
index 000000000000..82969121187b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA121.md
@@ -0,0 +1,10 @@
+Quarantine policies should use supported filter policy actions that are appropriate for the threat level. Different types of threats require different quarantine actions - for example, high-confidence phishing should be strictly quarantined with limited user interaction, while spam can be more lenient. Using appropriate quarantine policies ensures effective threat containment while minimizing false positive impact.
+
+**Remediation action**
+
+- [Quarantine policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/quarantine-policies)
+- [Anatomy of a quarantine policy](https://learn.microsoft.com/microsoft-365/security/office-365-security/quarantine-policies#anatomy-of-a-quarantine-policy)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA121.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA121.ps1
new file mode 100644
index 000000000000..cbf3d7499d06
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA121.ps1
@@ -0,0 +1,27 @@
+function Invoke-CippTestORCA121 {
+    <#
+    .SYNOPSIS
+    Supported filter policy action used
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoQuarantinePolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA121' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Supported filter policy action used' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Quarantine'
+            return
+        }
+
+        $Status = 'Passed'
+        $Result = "Quarantine policies are configured to support Zero Hour Auto Purge.`n`n"
+        $Result += "**Total Policies:** $($Policies.Count)"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA121' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Supported filter policy action used' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Quarantine'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA121' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Supported filter policy action used' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Quarantine'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA123.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA123.md
new file mode 100644
index 000000000000..95e74e9e953d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA123.md
@@ -0,0 +1,10 @@
+Anti-phishing policies should enable unusual characters safety tips to warn users when they receive messages containing unusual or suspicious characters. This feature helps protect users from internationalized domain name (IDN) homograph attacks and other obfuscation techniques where attackers use special characters to make malicious URLs or sender addresses appear legitimate.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about)
+- [Safety tips in email messages](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection-about#safety-tips-in-email-messages)
+- [Set up anti-phishing policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA123.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA123.ps1
new file mode 100644
index 000000000000..dd08fdaee61c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA123.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA123 {
+    <#
+    .SYNOPSIS
+    Unusual Characters Safety Tips is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA123' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Unusual Characters Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableUnusualCharactersSafetyTips -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have Unusual Characters Safety Tips enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have Unusual Characters Safety Tips enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Unusual Characters Safety Tips |`n"
+            $Result += "|------------|---------------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableUnusualCharactersSafetyTips) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA123' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Unusual Characters Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA123' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Unusual Characters Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA124.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA124.md
new file mode 100644
index 000000000000..f300609ca082
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA124.md
@@ -0,0 +1,10 @@
+Safe Attachments policies should configure the unknown malware response to block messages containing potentially malicious attachments. This setting ensures that messages with attachments that cannot be verified as safe are blocked from delivery, preventing zero-day malware attacks and protecting users from unknown threats until they can be properly analyzed.
+
+**Remediation action**
+
+- [Safe Attachments in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-about)
+- [Set up Safe Attachments policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA124.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA124.ps1
new file mode 100644
index 000000000000..dcfe7a48b9c8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA124.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA124 {
+    <#
+    .SYNOPSIS
+    Safe attachments unknown malware response set to block messages
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeAttachmentPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA124' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe attachments unknown malware response set to block messages' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.Action -in @('Block', 'Quarantine')) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Attachments policies have unknown malware response set to Block.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) Safe Attachments policies do not have unknown malware response set to Block.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Action |`n"
+            $Result += "|------------|--------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.Action) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA124' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe attachments unknown malware response set to block messages' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA124' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe attachments unknown malware response set to block messages' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA139.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA139.md
new file mode 100644
index 000000000000..d79529c834b0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA139.md
@@ -0,0 +1,8 @@
+Anti-spam policies should be configured to move spam messages to the Junk Email folder or quarantine them to protect users from potentially malicious content. Setting the spam action to "Move to Junk Email Folder" or "Quarantine" ensures that spam is properly filtered while still allowing users to review quarantined messages if needed.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA139.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA139.ps1
new file mode 100644
index 000000000000..d285fb841375
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA139.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA139 {
+    <#
+    .SYNOPSIS
+    Spam action set to move message to junk mail folder or quarantine
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA139' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Spam action set to move message to junk mail folder or quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.SpamAction -in @('MoveToJmf', 'Quarantine')) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have Spam action set to move to Junk Email folder or Quarantine.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have Spam action set appropriately.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Spam Action |`n"
+            $Result += "|------------|------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.SpamAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA139' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Spam action set to move message to junk mail folder or quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA139' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Spam action set to move message to junk mail folder or quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA140.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA140.md
new file mode 100644
index 000000000000..180dd069263a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA140.md
@@ -0,0 +1,8 @@
+High confidence spam messages are very likely to be spam and should be quarantined to prevent them from reaching users' inboxes. Setting the high confidence spam action to "Quarantine" provides the strongest protection against spam while maintaining the ability to review and release false positives if necessary.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA140.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA140.ps1
new file mode 100644
index 000000000000..df9bc587b330
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA140.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA140 {
+    <#
+    .SYNOPSIS
+    High Confidence Spam action set to Quarantine message
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA140' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'High Confidence Spam action set to Quarantine message' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.HighConfidenceSpamAction -eq 'Quarantine') {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have High Confidence Spam action set to Quarantine.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have High Confidence Spam action set to Quarantine.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | High Confidence Spam Action |`n"
+            $Result += "|------------|---------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.HighConfidenceSpamAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA140' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'High Confidence Spam action set to Quarantine message' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA140' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'High Confidence Spam action set to Quarantine message' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA141.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA141.md
new file mode 100644
index 000000000000..1b07c3a2e640
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA141.md
@@ -0,0 +1,8 @@
+Bulk email messages should be moved to the Junk Email folder to reduce inbox clutter while maintaining access for users who may want to receive such communications. Setting the bulk action to "Move to Junk Email Folder" or "Quarantine" helps filter marketing emails and mass mailings appropriately based on the Bulk Complaint Level (BCL) threshold.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Bulk Complaint Level (BCL) in Exchange Online Protection](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-bulk-complaint-level-bcl-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA141.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA141.ps1
new file mode 100644
index 000000000000..678b28afb0ec
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA141.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA141 {
+    <#
+    .SYNOPSIS
+    Bulk action set to Move message to Junk Email Folder
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA141' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Bulk action set to Move message to Junk Email Folder' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.BulkSpamAction -in @('MoveToJmf', 'Quarantine')) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have Bulk action set to Move to Junk Email folder.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have Bulk action set to Move to Junk Email folder.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Bulk Spam Action |`n"
+            $Result += "|------------|-----------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.BulkSpamAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA141' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Bulk action set to Move message to Junk Email Folder' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA141' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Bulk action set to Move message to Junk Email Folder' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA142.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA142.md
new file mode 100644
index 000000000000..eb1d0efd8295
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA142.md
@@ -0,0 +1,8 @@
+Messages identified as phishing attempts should be quarantined immediately to protect users from credential theft and malicious content. Setting the phishing spam action to "Quarantine" prevents these dangerous messages from reaching user mailboxes while allowing administrators to review and analyze them for security purposes.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA142.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA142.ps1
new file mode 100644
index 000000000000..41c7dcddbb2f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA142.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA142 {
+    <#
+    .SYNOPSIS
+    Phish action set to Quarantine message
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA142' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Phish action set to Quarantine message' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.PhishSpamAction -eq 'Quarantine') {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have Phish action set to Quarantine.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have Phish action set to Quarantine.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Phish Spam Action |`n"
+            $Result += "|------------|------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.PhishSpamAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA142' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Phish action set to Quarantine message' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA142' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Phish action set to Quarantine message' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA143.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA143.md
new file mode 100644
index 000000000000..467eebcd10a6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA143.md
@@ -0,0 +1,8 @@
+Safety Tips provide inline warnings in email messages to help users identify suspicious or potentially dangerous content. Enabling Safety Tips displays visual indicators for spam, phishing, and spoofing attempts directly in the email client, helping users make informed decisions about email safety.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Safety tips in email messages in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-safety-tips-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA143.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA143.ps1
new file mode 100644
index 000000000000..6056b9cc78ad
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA143.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA143 {
+    <#
+    .SYNOPSIS
+    Safety Tips are enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA143' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Safety Tips are enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.InlineSafetyTipsEnabled -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies have Safety Tips enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not have Safety Tips enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Inline Safety Tips Enabled |`n"
+            $Result += "|------------|---------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.InlineSafetyTipsEnabled) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA143' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Safety Tips are enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA143' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Safety Tips are enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA156.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA156.md
new file mode 100644
index 000000000000..85ca74b26e19
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA156.md
@@ -0,0 +1,8 @@
+Safe Links should track user clicks on protected URLs to provide visibility into potential security threats and user behavior. Enabling click tracking allows administrators to monitor which users are clicking on potentially dangerous links and helps identify targeted attacks or compromised accounts.
+
+**Remediation action**
+
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA156.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA156.ps1
new file mode 100644
index 000000000000..d73eb7152c02
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA156.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA156 {
+    <#
+    .SYNOPSIS
+    Safe Links Policies are tracking when user clicks on safe links
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA156' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Safe Links Policies are tracking user clicks' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.TrackClicks -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Links policies are tracking user clicks.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) Safe Links policies are not tracking user clicks.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Track Clicks |`n"
+            $Result += "|------------|-------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.TrackClicks) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA156' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Low' -Name 'Safe Links Policies are tracking user clicks' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA156' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Safe Links Policies are tracking user clicks' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA158.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA158.md
new file mode 100644
index 000000000000..ed9aadb907e4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA158.md
@@ -0,0 +1,8 @@
+Safe Attachments protection should be enabled for SharePoint, OneDrive, and Microsoft Teams to scan files for malicious content before users can access them. This protection helps prevent malware from spreading through file sharing and collaboration platforms, providing an additional layer of security beyond email protection.
+
+**Remediation action**
+
+- [Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-for-spo-odfb-teams-configure)
+- [Safe Attachments in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA158.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA158.ps1
new file mode 100644
index 000000000000..8f8852090651
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA158.ps1
@@ -0,0 +1,35 @@
+function Invoke-CippTestORCA158 {
+    <#
+    .SYNOPSIS
+    Safe Attachments is enabled for SharePoint and Teams
+    #>
+    param($Tenant)
+
+    try {
+        $AtpPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAtpPolicyForO365'
+
+        if (-not $AtpPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA158' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe Attachments enabled for SharePoint and Teams' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+            return
+        }
+
+        $Policy = $AtpPolicy | Select-Object -First 1
+
+        if ($Policy.EnableATPForSPOTeamsODB -eq $true) {
+            $Status = 'Passed'
+            $Result = "Safe Attachments is enabled for SharePoint, OneDrive, and Teams.`n`n"
+            $Result += "**EnableATPForSPOTeamsODB:** $($Policy.EnableATPForSPOTeamsODB)"
+        } else {
+            $Status = 'Failed'
+            $Result = "Safe Attachments is NOT enabled for SharePoint, OneDrive, and Teams.`n`n"
+            $Result += "**EnableATPForSPOTeamsODB:** $($Policy.EnableATPForSPOTeamsODB)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA158' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe Attachments enabled for SharePoint and Teams' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA158' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe Attachments enabled for SharePoint and Teams' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.md
new file mode 100644
index 000000000000..b880df63edae
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.md
@@ -0,0 +1,8 @@
+Safe Links should be enabled for internal email messages to protect against threats from compromised accounts within the organization. While external threats are the primary concern, internal accounts can be compromised and used to spread malicious links to other users in the organization.
+
+**Remediation action**
+
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.ps1
new file mode 100644
index 000000000000..e72205f9ee4c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA179 {
+    <#
+    .SYNOPSIS
+    Safe Links is enabled intra-organization
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA179' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Safe Links is enabled intra-organization' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableForInternalSenders -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Links policies are enabled for internal senders.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) Safe Links policies are not enabled for internal senders.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable For Internal Senders |`n"
+            $Result += "|------------|----------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableForInternalSenders) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA179' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Safe Links is enabled intra-organization' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA179' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Safe Links is enabled intra-organization' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA180.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA180.md
new file mode 100644
index 000000000000..5f39f69bcc2d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA180.md
@@ -0,0 +1,8 @@
+Spoof Intelligence uses machine learning to distinguish between legitimate and malicious email spoofing attempts. Enabling Spoof Intelligence in anti-phishing policies helps protect users from impersonation attacks by analyzing sender patterns and blocking suspicious spoofed messages while allowing legitimate forwarded or mailing list messages.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Spoof intelligence insight in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spoofing-spoof-intelligence)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA180.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA180.ps1
new file mode 100644
index 000000000000..af5b1840cd38
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA180.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA180 {
+    <#
+    .SYNOPSIS
+    Anti-phishing policy exists and EnableSpoofIntelligence is true
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA180' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Spoof Intelligence is enabled' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableSpoofIntelligence -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have Spoof Intelligence enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have Spoof Intelligence enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Spoof Intelligence |`n"
+            $Result += "|------------|--------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableSpoofIntelligence) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA180' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Spoof Intelligence is enabled' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA180' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Spoof Intelligence is enabled' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189.md
new file mode 100644
index 000000000000..5b25d1b0ad4c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189.md
@@ -0,0 +1,8 @@
+Transport rules should not be configured to bypass Safe Attachments scanning. Bypassing Safe Attachments processing creates a security gap that allows malicious files to reach users without being scanned, potentially leading to malware infections and data breaches. All email messages should go through Safe Attachments scanning to ensure comprehensive protection.
+
+**Remediation action**
+
+- [Review and modify transport rules in Exchange Online](https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules)
+- [Safe Attachments in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189.ps1
new file mode 100644
index 000000000000..aa26117ba876
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189.ps1
@@ -0,0 +1,43 @@
+function Invoke-CippTestORCA189 {
+    <#
+    .SYNOPSIS
+    Safe Attachments is not bypassed
+    #>
+    param($Tenant)
+    
+    try {
+        $Rules = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoTransportRules'
+        
+        if (-not $Rules) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA189' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe Attachments is not bypassed' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+            return
+        }
+
+        $BypassRules = [System.Collections.Generic.List[object]]::new()
+        foreach ($Rule in $Rules) {
+            if ($Rule.SetHeaderName -eq 'X-MS-Exchange-Organization-SkipSafeAttachmentProcessing' -and $Rule.SetHeaderValue -eq '1') {
+                $BypassRules.Add($Rule) | Out-Null
+            }
+        }
+
+        if ($BypassRules.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No transport rules are bypassing Safe Attachments processing."
+        } else {
+            $Status = 'Failed'
+            $Result = "$($BypassRules.Count) transport rules are bypassing Safe Attachments processing.`n`n"
+            $Result += "| Rule Name | Priority |`n"
+            $Result += "|-----------|----------|`n"
+            foreach ($Rule in $BypassRules) {
+                $Result += "| $($Rule.Name) | $($Rule.Priority) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA189' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe Attachments is not bypassed' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA189' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe Attachments is not bypassed' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189_2.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189_2.md
new file mode 100644
index 000000000000..586b2d1ad64d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189_2.md
@@ -0,0 +1,8 @@
+Transport rules should not be configured to bypass Safe Links protection. Bypassing Safe Links processing disables URL scanning and protection, allowing potentially malicious links to reach users without being analyzed. This creates a significant security vulnerability that attackers can exploit to deliver phishing and malware attacks.
+
+**Remediation action**
+
+- [Review and modify transport rules in Exchange Online](https://learn.microsoft.com/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules)
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189_2.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189_2.ps1
new file mode 100644
index 000000000000..62ee60914a2a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA189_2.ps1
@@ -0,0 +1,43 @@
+function Invoke-CippTestORCA189_2 {
+    <#
+    .SYNOPSIS
+    Safe Links is not bypassed
+    #>
+    param($Tenant)
+    
+    try {
+        $Rules = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoTransportRules'
+        
+        if (-not $Rules) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA189_2' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe Links is not bypassed' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $BypassRules = [System.Collections.Generic.List[object]]::new()
+        foreach ($Rule in $Rules) {
+            if ($Rule.SetHeaderName -eq 'X-MS-Exchange-Organization-SkipSafeLinksProcessing' -and $Rule.SetHeaderValue -eq '1') {
+                $BypassRules.Add($Rule) | Out-Null
+            }
+        }
+
+        if ($BypassRules.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No transport rules are bypassing Safe Links processing."
+        } else {
+            $Status = 'Failed'
+            $Result = "$($BypassRules.Count) transport rules are bypassing Safe Links processing.`n`n"
+            $Result += "| Rule Name | Priority |`n"
+            $Result += "|-----------|----------|`n"
+            foreach ($Rule in $BypassRules) {
+                $Result += "| $($Rule.Name) | $($Rule.Priority) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA189_2' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe Links is not bypassed' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA189_2' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe Links is not bypassed' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA205.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA205.md
new file mode 100644
index 000000000000..e25749c79d9d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA205.md
@@ -0,0 +1,8 @@
+Common attachment type filtering automatically blocks file types commonly used for malware delivery, such as executable files, scripts, and certain document types. Enabling this feature provides an additional layer of protection by preventing dangerous file types from reaching user mailboxes, even if malware signatures are not yet detected.
+
+**Remediation action**
+
+- [Configure anti-malware policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-policies-configure)
+- [Anti-malware protection in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-protection-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA205.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA205.ps1
new file mode 100644
index 000000000000..51ecc2c16d88
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA205.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA205 {
+    <#
+    .SYNOPSIS
+    Common attachment type filter is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA205' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Common attachment type filter is enabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Malware'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableFileFilter -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All malware filter policies have common attachment type filter enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) malware filter policies do not have common attachment type filter enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable File Filter |`n"
+            $Result += "|------------|-------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableFileFilter) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA205' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Common attachment type filter is enabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Malware'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA205' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Common attachment type filter is enabled' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Malware'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA220.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA220.md
new file mode 100644
index 000000000000..963b965b6e75
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA220.md
@@ -0,0 +1,8 @@
+The phishing threshold level determines how aggressively anti-phishing policies identify and block phishing attempts. Setting the threshold to level 2 (Aggressive) or higher provides stronger protection against sophisticated phishing attacks by applying more stringent detection criteria, though it may increase the risk of false positives for legitimate messages.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA220.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA220.ps1
new file mode 100644
index 000000000000..d266a8461cd1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA220.ps1
@@ -0,0 +1,50 @@
+function Invoke-CippTestORCA220 {
+    <#
+    .SYNOPSIS
+    Advanced Phish filter Threshold level is adequate
+    #>
+    param($Tenant)
+    
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+        
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA220' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Advanced Phish filter Threshold level is adequate' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            # PhishThresholdLevel: 1=Standard, 2=Aggressive, 3=More Aggressive, 4=Most Aggressive
+            if ($Policy.PhishThresholdLevel -ge 2) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have adequate phishing threshold levels (2 or higher).`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies have inadequate phishing threshold levels.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Phish Threshold Level |`n"
+            $Result += "|------------|----------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.PhishThresholdLevel) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA220' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Advanced Phish filter Threshold level is adequate' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA220' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Advanced Phish filter Threshold level is adequate' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA221.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA221.md
new file mode 100644
index 000000000000..85d5fb232935
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA221.md
@@ -0,0 +1,8 @@
+Mailbox intelligence uses machine learning to understand each user's email patterns and communication habits to better detect impersonation attempts. When enabled, this feature analyzes historical email data to identify when someone is attempting to impersonate a user's regular contacts, providing personalized protection against targeted phishing attacks.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Impersonation insight in Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-mdo-impersonation-insight)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA221.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA221.ps1
new file mode 100644
index 000000000000..f76784f3680d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA221.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA221 {
+    <#
+    .SYNOPSIS
+    Mailbox intelligence is enabled in anti-phishing policies
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA221' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Mailbox intelligence is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableMailboxIntelligence -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have mailbox intelligence enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have mailbox intelligence enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Mailbox Intelligence |`n"
+            $Result += "|------------|----------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableMailboxIntelligence) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA221' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Mailbox intelligence is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA221' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Mailbox intelligence is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA222.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA222.md
new file mode 100644
index 000000000000..42c43006016e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA222.md
@@ -0,0 +1,8 @@
+Domain impersonation protection should quarantine messages that attempt to impersonate protected domains. When attackers try to spoof your organization's domain or partner domains, quarantining these messages prevents users from interacting with potentially malicious content designed to look like legitimate communication from trusted domains.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Impersonation protection in anti-phishing policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA222.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA222.ps1
new file mode 100644
index 000000000000..14d2ccc5e552
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA222.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA222 {
+    <#
+    .SYNOPSIS
+    Domain Impersonation action is set to move to Quarantine
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA222' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Domain Impersonation action set to Quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.TargetedDomainProtectionAction -eq 'Quarantine') {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have Domain Impersonation action set to Quarantine.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have Domain Impersonation action set to Quarantine.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Targeted Domain Protection Action |`n"
+            $Result += "|------------|----------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.TargetedDomainProtectionAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA222' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Domain Impersonation action set to Quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA222' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Domain Impersonation action set to Quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA223.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA223.md
new file mode 100644
index 000000000000..2be219b8fdf5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA223.md
@@ -0,0 +1,8 @@
+User impersonation protection should quarantine messages that attempt to impersonate protected users such as executives and other high-value targets. Quarantining these messages prevents sophisticated spear-phishing attacks that target specific individuals by impersonating their trusted contacts, colleagues, or business partners.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Impersonation protection in anti-phishing policies](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-about#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA223.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA223.ps1
new file mode 100644
index 000000000000..3600edeb0723
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA223.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA223 {
+    <#
+    .SYNOPSIS
+    User impersonation action is set to move to Quarantine
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA223' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'User impersonation action set to Quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.TargetedUserProtectionAction -eq 'Quarantine') {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have User Impersonation action set to Quarantine.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have User Impersonation action set to Quarantine.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Targeted User Protection Action |`n"
+            $Result += "|------------|--------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.TargetedUserProtectionAction) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA223' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'User impersonation action set to Quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA223' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'User impersonation action set to Quarantine' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA224.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA224.md
new file mode 100644
index 000000000000..05fbf80bfdbe
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA224.md
@@ -0,0 +1,8 @@
+Similar Users Safety Tips display warnings when messages appear to come from senders with names similar to protected users in your organization. This visual indicator helps users identify potential impersonation attempts where attackers use slightly misspelled or visually similar names to trick recipients into believing the message is from a trusted colleague.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Safety tips in email messages in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-safety-tips-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA224.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA224.ps1
new file mode 100644
index 000000000000..77e84a0a96cf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA224.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA224 {
+    <#
+    .SYNOPSIS
+    Similar Users Safety Tips is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA224' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Similar Users Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableSimilarUsersSafetyTips -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have Similar Users Safety Tips enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have Similar Users Safety Tips enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Similar Users Safety Tips |`n"
+            $Result += "|------------|----------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableSimilarUsersSafetyTips) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA224' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Similar Users Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA224' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Similar Users Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA225.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA225.md
new file mode 100644
index 000000000000..838e80444335
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA225.md
@@ -0,0 +1,8 @@
+Safe Documents uses Microsoft Defender for Endpoint to scan documents opened in Office applications in Protected View. When enabled, this feature provides additional protection by analyzing Office files for malicious content before allowing users to edit them, helping prevent zero-day attacks and advanced threats delivered through documents.
+
+**Remediation action**
+
+- [Safe Documents in Microsoft 365 E5](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-documents-in-e5-plus-security-about)
+- [Enable Safe Documents for Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-documents-in-e5-plus-security-about#use-the-microsoft-365-defender-portal-to-configure-safe-documents)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA225.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA225.ps1
new file mode 100644
index 000000000000..9c0fc333de87
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA225.ps1
@@ -0,0 +1,35 @@
+function Invoke-CippTestORCA225 {
+    <#
+    .SYNOPSIS
+    Safe Documents is enabled for Office clients
+    #>
+    param($Tenant)
+
+    try {
+        $AtpPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAtpPolicyForO365'
+
+        if (-not $AtpPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA225' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Safe Documents is enabled for Office clients' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+            return
+        }
+
+        $Policy = $AtpPolicy | Select-Object -First 1
+
+        if ($Policy.EnableSafeDocs -eq $true) {
+            $Status = 'Passed'
+            $Result = "Safe Documents is enabled for Office clients.`n`n"
+            $Result += "**EnableSafeDocs:** $($Policy.EnableSafeDocs)"
+        } else {
+            $Status = 'Failed'
+            $Result = "Safe Documents is NOT enabled for Office clients.`n`n"
+            $Result += "**EnableSafeDocs:** $($Policy.EnableSafeDocs)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA225' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Safe Documents is enabled for Office clients' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA225' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Safe Documents is enabled for Office clients' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.md
new file mode 100644
index 000000000000..29973d736834
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.md
@@ -0,0 +1,8 @@
+Each accepted domain in your organization should be covered by a Safe Links policy to ensure all users receive URL protection. Without domain-specific Safe Links coverage, users in certain domains may not be protected from malicious links, creating security gaps that attackers can exploit to target specific business units or subsidiaries.
+
+**Remediation action**
+
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.ps1
new file mode 100644
index 000000000000..81c895569cb6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.ps1
@@ -0,0 +1,60 @@
+function Invoke-CippTestORCA226 {
+    <#
+    .SYNOPSIS
+    Each domain has a Safe Links policy
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+        $SafeLinksPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
+            return
+        }
+
+        if (-not $SafeLinksPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Links policies found. Each domain should have a Safe Links policy.' -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
+            return
+        }
+
+        # Get all recipient domains from policies
+        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
+        foreach ($Policy in $SafeLinksPolicies) {
+            if ($Policy.RecipientDomainIs) {
+                foreach ($Domain in $Policy.RecipientDomainIs) {
+                    $CoveredDomains.Add($Domain) | Out-Null
+                }
+            }
+        }
+
+        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        foreach ($Domain in $AcceptedDomains) {
+            if ($CoveredDomains -notcontains $Domain.DomainName) {
+                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            }
+        }
+
+        if ($DomainsWithoutPolicy.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All accepted domains are covered by Safe Links policies.`n`n"
+            $Result += "**Total Accepted Domains:** $($AcceptedDomains.Count)`n"
+            $Result += "**Total Safe Links Policies:** $($SafeLinksPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($DomainsWithoutPolicy.Count) domains do not have a Safe Links policy.`n`n"
+            $Result += "**Domains Without Policy:**`n`n"
+            foreach ($Domain in $DomainsWithoutPolicy) {
+                $Result += "- $Domain`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.md
new file mode 100644
index 000000000000..ad2b56ce49db
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.md
@@ -0,0 +1,8 @@
+Each accepted domain in your organization should be covered by a Safe Attachments policy to ensure all users receive malware protection. Without domain-specific Safe Attachments coverage, users in certain domains may not be protected from malicious files, creating security vulnerabilities that can be exploited to deliver malware to unprotected segments of your organization.
+
+**Remediation action**
+
+- [Set up Safe Attachments policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-attachments-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.ps1
new file mode 100644
index 000000000000..deb01c9eda53
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.ps1
@@ -0,0 +1,60 @@
+function Invoke-CippTestORCA227 {
+    <#
+    .SYNOPSIS
+    Each domain has a Safe Attachments policy
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+        $SafeAttachmentPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeAttachmentPolicies'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
+            return
+        }
+
+        if (-not $SafeAttachmentPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Attachments policies found. Each domain should have a Safe Attachments policy.' -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
+            return
+        }
+
+        # Get all recipient domains from policies
+        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
+        foreach ($Policy in $SafeAttachmentPolicies) {
+            if ($Policy.RecipientDomainIs) {
+                foreach ($Domain in $Policy.RecipientDomainIs) {
+                    $CoveredDomains.Add($Domain) | Out-Null
+                }
+            }
+        }
+
+        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        foreach ($Domain in $AcceptedDomains) {
+            if ($CoveredDomains -notcontains $Domain.DomainName) {
+                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            }
+        }
+
+        if ($DomainsWithoutPolicy.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All accepted domains are covered by Safe Attachments policies.`n`n"
+            $Result += "**Total Accepted Domains:** $($AcceptedDomains.Count)`n"
+            $Result += "**Total Safe Attachments Policies:** $($SafeAttachmentPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($DomainsWithoutPolicy.Count) domains do not have a Safe Attachments policy.`n`n"
+            $Result += "**Domains Without Policy:**`n`n"
+            foreach ($Domain in $DomainsWithoutPolicy) {
+                $Result += "- $Domain`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA228.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA228.md
new file mode 100644
index 000000000000..cf9282fab859
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA228.md
@@ -0,0 +1,8 @@
+Anti-phishing policies should not include trusted senders or exclusions, as this creates security gaps that attackers can exploit. Excluding senders from anti-phishing protection means those addresses can be spoofed without detection, allowing attackers to bypass impersonation and spoof protection by using excluded addresses in their phishing campaigns.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA228.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA228.ps1
new file mode 100644
index 000000000000..8a25941105f8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA228.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestORCA228 {
+    <#
+    .SYNOPSIS
+    No trusted senders in Anti-phishing policy
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA228' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'No trusted senders in Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $HasTrustedSenders = ($Policy.ExcludedSenders -and $Policy.ExcludedSenders.Count -gt 0)
+
+            if (-not $HasTrustedSenders) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No anti-phishing policies have trusted senders configured.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies have trusted senders configured.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Excluded Senders Count |`n"
+            $Result += "|------------|----------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Count = if ($Policy.ExcludedSenders) { $Policy.ExcludedSenders.Count } else { 0 }
+                $Result += "| $($Policy.Identity) | $Count |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA228' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'No trusted senders in Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA228' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'No trusted senders in Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA229.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA229.md
new file mode 100644
index 000000000000..3e85642c5d9f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA229.md
@@ -0,0 +1,8 @@
+Anti-phishing policies should not include trusted domains or exclusions, as this weakens domain impersonation protection. Excluding domains from anti-phishing checks allows attackers to register similar-looking domains or spoof excluded domains without triggering security alerts, making it easier to conduct convincing phishing attacks against your users.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA229.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA229.ps1
new file mode 100644
index 000000000000..c9c8ba9fa1cd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA229.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestORCA229 {
+    <#
+    .SYNOPSIS
+    No trusted domains in Anti-phishing policy
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA229' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'No trusted domains in Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            $HasTrustedDomains = ($Policy.ExcludedDomains -and $Policy.ExcludedDomains.Count -gt 0)
+
+            if (-not $HasTrustedDomains) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No anti-phishing policies have trusted domains configured.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies have trusted domains configured.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Excluded Domains Count |`n"
+            $Result += "|------------|----------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Count = if ($Policy.ExcludedDomains) { $Policy.ExcludedDomains.Count } else { 0 }
+                $Result += "| $($Policy.Identity) | $Count |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA229' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'No trusted domains in Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA229' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'No trusted domains in Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.md
new file mode 100644
index 000000000000..1c8dae777e9c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.md
@@ -0,0 +1,8 @@
+Each accepted domain in your organization should be covered by an anti-phishing policy to ensure all users receive protection from impersonation and spoofing attacks. Without domain-specific anti-phishing coverage, users in certain domains may be vulnerable to targeted phishing campaigns that exploit the lack of protection for their email addresses.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.ps1
new file mode 100644
index 000000000000..8d72b0ffaccb
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.ps1
@@ -0,0 +1,60 @@
+function Invoke-CippTestORCA230 {
+    <#
+    .SYNOPSIS
+    Each domain has an Anti-phishing policy
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+        $AntiPhishPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
+            return
+        }
+
+        if (-not $AntiPhishPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Anti-phishing policies found. Each domain should have an Anti-phishing policy.' -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
+            return
+        }
+
+        # Get all recipient domains from policies
+        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
+        foreach ($Policy in $AntiPhishPolicies) {
+            if ($Policy.RecipientDomainIs) {
+                foreach ($Domain in $Policy.RecipientDomainIs) {
+                    $CoveredDomains.Add($Domain) | Out-Null
+                }
+            }
+        }
+
+        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        foreach ($Domain in $AcceptedDomains) {
+            if ($CoveredDomains -notcontains $Domain.DomainName) {
+                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            }
+        }
+
+        if ($DomainsWithoutPolicy.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All accepted domains are covered by Anti-phishing policies.`n`n"
+            $Result += "**Total Accepted Domains:** $($AcceptedDomains.Count)`n"
+            $Result += "**Total Anti-phishing Policies:** $($AntiPhishPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($DomainsWithoutPolicy.Count) domains do not have an Anti-phishing policy.`n`n"
+            $Result += "**Domains Without Policy:**`n`n"
+            foreach ($Domain in $DomainsWithoutPolicy) {
+                $Result += "- $Domain`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.md
new file mode 100644
index 000000000000..47e7daa0084e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.md
@@ -0,0 +1,8 @@
+Each accepted domain in your organization should be covered by an anti-spam policy to ensure all users receive protection from unwanted and malicious email. Without domain-specific anti-spam coverage, users in certain domains may receive higher volumes of spam and potentially malicious messages, increasing security risks and reducing productivity.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.ps1
new file mode 100644
index 000000000000..2dd1c57ef583
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.ps1
@@ -0,0 +1,60 @@
+function Invoke-CippTestORCA231 {
+    <#
+    .SYNOPSIS
+    Each domain has an anti-spam policy
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+        $ContentFilterPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
+            return
+        }
+
+        if (-not $ContentFilterPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No anti-spam policies found. Each domain should have an anti-spam policy.' -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
+            return
+        }
+
+        # Get all recipient domains from policies
+        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
+        foreach ($Policy in $ContentFilterPolicies) {
+            if ($Policy.RecipientDomainIs) {
+                foreach ($Domain in $Policy.RecipientDomainIs) {
+                    $CoveredDomains.Add($Domain) | Out-Null
+                }
+            }
+        }
+
+        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        foreach ($Domain in $AcceptedDomains) {
+            if ($CoveredDomains -notcontains $Domain.DomainName) {
+                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            }
+        }
+
+        if ($DomainsWithoutPolicy.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All accepted domains are covered by anti-spam policies.`n`n"
+            $Result += "**Total Accepted Domains:** $($AcceptedDomains.Count)`n"
+            $Result += "**Total Anti-spam Policies:** $($ContentFilterPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($DomainsWithoutPolicy.Count) domains do not have an anti-spam policy.`n`n"
+            $Result += "**Domains Without Policy:**`n`n"
+            foreach ($Domain in $DomainsWithoutPolicy) {
+                $Result += "- $Domain`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.md
new file mode 100644
index 000000000000..9a2b166214ea
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.md
@@ -0,0 +1,8 @@
+Each accepted domain in your organization should be covered by a malware filter policy to ensure all users receive protection from malicious attachments and files. Without domain-specific malware filtering, users in certain domains may be exposed to viruses, trojans, and other malware delivered through email, creating potential entry points for security breaches.
+
+**Remediation action**
+
+- [Configure anti-malware policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.ps1
new file mode 100644
index 000000000000..f42577954039
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.ps1
@@ -0,0 +1,60 @@
+function Invoke-CippTestORCA232 {
+    <#
+    .SYNOPSIS
+    Each domain has a malware filter policy
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+        $MalwarePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicies'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
+            return
+        }
+
+        if (-not $MalwarePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No malware filter policies found. Each domain should have a malware filter policy.' -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
+            return
+        }
+
+        # Get all recipient domains from policies
+        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
+        foreach ($Policy in $MalwarePolicies) {
+            if ($Policy.RecipientDomainIs) {
+                foreach ($Domain in $Policy.RecipientDomainIs) {
+                    $CoveredDomains.Add($Domain) | Out-Null
+                }
+            }
+        }
+
+        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        foreach ($Domain in $AcceptedDomains) {
+            if ($CoveredDomains -notcontains $Domain.DomainName) {
+                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            }
+        }
+
+        if ($DomainsWithoutPolicy.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All accepted domains are covered by malware filter policies.`n`n"
+            $Result += "**Total Accepted Domains:** $($AcceptedDomains.Count)`n"
+            $Result += "**Total Malware Filter Policies:** $($MalwarePolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($DomainsWithoutPolicy.Count) domains do not have a malware filter policy.`n`n"
+            $Result += "**Domains Without Policy:**`n`n"
+            foreach ($Domain in $DomainsWithoutPolicy) {
+                $Result += "- $Domain`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233.md
new file mode 100644
index 000000000000..e946c14da7cf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233.md
@@ -0,0 +1,8 @@
+Custom domains should have their MX records pointed directly at Exchange Online Protection (EOP) or use enhanced filtering with inbound connectors. This ensures that all email security features function properly, including SPF, DKIM, and DMARC validation. When mail flows through third-party services without proper configuration, important security signals can be lost.
+
+**Remediation action**
+
+- [Mail flow best practices for Exchange Online and Microsoft 365](https://learn.microsoft.com/exchange/mail-flow-best-practices/mail-flow-best-practices)
+- [Enhanced filtering for connectors in Exchange Online](https://learn.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233.ps1
new file mode 100644
index 000000000000..71815b0b0e78
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233.ps1
@@ -0,0 +1,55 @@
+function Invoke-CippTestORCA233 {
+    <#
+    .SYNOPSIS
+    Domains pointed at EOP or enhanced filtering used
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA233' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Domains pointed at EOP or enhanced filtering used' -UserImpact 'High' -ImplementationEffort 'High' -Category 'Configuration'
+            return
+        }
+
+        # This test requires checking MX records and inbound connectors which may not be available
+        # We'll check if domains are authoritative (pointed at EOP) or use external mail flow
+        $NonCompliantDomains = [System.Collections.Generic.List[string]]::new()
+        $CompliantDomains = [System.Collections.Generic.List[string]]::new()
+
+        foreach ($Domain in $AcceptedDomains) {
+            # Authoritative domains point MX to EOP
+            # InternalRelay/ExternalRelay domains use inbound connectors with enhanced filtering
+            if ($Domain.DomainType -eq 'Authoritative') {
+                $CompliantDomains.Add($Domain.DomainName) | Out-Null
+            } elseif ($Domain.DomainType -in @('InternalRelay', 'ExternalRelay')) {
+                # These should have enhanced filtering configured on inbound connectors
+                # For now, we'll mark these as compliant if they exist
+                $CompliantDomains.Add($Domain.DomainName) | Out-Null
+            } else {
+                $NonCompliantDomains.Add($Domain.DomainName) | Out-Null
+            }
+        }
+
+        if ($NonCompliantDomains.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All domains are properly configured for mail flow.`n`n"
+            $Result += "**Compliant Domains:** $($CompliantDomains.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($NonCompliantDomains.Count) domains may not be properly configured for mail flow.`n`n"
+            $Result += "**Domains Needing Review:**`n`n"
+            foreach ($Domain in $NonCompliantDomains) {
+                $Result += "- $Domain`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA233' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Domains pointed at EOP or enhanced filtering used' -UserImpact 'High' -ImplementationEffort 'High' -Category 'Configuration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA233' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Domains pointed at EOP or enhanced filtering used' -UserImpact 'High' -ImplementationEffort 'High' -Category 'Configuration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.md
new file mode 100644
index 000000000000..00f8a4abfbab
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.md
@@ -0,0 +1,8 @@
+Enhanced filtering should be configured on inbound connectors when mail flows through third-party services before reaching Exchange Online. This feature preserves important email authentication signals and source IP information that would otherwise be lost, enabling proper SPF, DKIM, and DMARC validation as well as accurate spam and phishing detection.
+
+**Remediation action**
+
+- [Enhanced filtering for connectors in Exchange Online](https://learn.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
+- [Mail flow best practices for Exchange Online and Microsoft 365](https://learn.microsoft.com/exchange/mail-flow-best-practices/mail-flow-best-practices)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.ps1
new file mode 100644
index 000000000000..3243ff67a450
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.ps1
@@ -0,0 +1,44 @@
+function Invoke-CippTestORCA233_1 {
+    <#
+    .SYNOPSIS
+    Enhanced filtering on default connectors
+    #>
+    param($Tenant)
+
+    try {
+        $OrgConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoOrganizationConfig'
+
+        if (-not $OrgConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA233_1' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No organization config found in database.' -Risk 'Medium' -Name 'Enhanced filtering on default connectors' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Configuration'
+            return
+        }
+
+        $Config = $OrgConfig | Select-Object -First 1
+
+        # Check if enhanced filtering is enabled
+        # This property may vary depending on Exchange Online version
+        $EnhancedFilteringEnabled = $false
+
+        # Check various properties that indicate enhanced filtering
+        if ($Config.PSObject.Properties.Name -contains 'SkipListedFromForging') {
+            $EnhancedFilteringEnabled = $Config.SkipListedFromForging -eq $false
+        }
+
+        if ($EnhancedFilteringEnabled) {
+            $Status = 'Passed'
+            $Result = "Enhanced filtering appears to be properly configured.`n`n"
+            $Result += "**Configuration:** Reviewed"
+        } else {
+            $Status = 'Informational'
+            $Result = "Unable to fully determine enhanced filtering status. Manual review recommended.`n`n"
+            $Result += "**Action Required:** Review inbound connectors for enhanced filtering configuration"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA233_1' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Enhanced filtering on default connectors' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Configuration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA233_1' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Enhanced filtering on default connectors' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Configuration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA234.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA234.md
new file mode 100644
index 000000000000..0db2874cead6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA234.md
@@ -0,0 +1,8 @@
+Safe Documents click-through protection should be disabled to prevent users from opening potentially dangerous files before they are fully analyzed. When click-through is enabled, users can bypass the security check and open files while they are still being scanned, potentially exposing their systems to malware before the threat is identified.
+
+**Remediation action**
+
+- [Safe Documents in Microsoft 365 E5](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-documents-in-e5-plus-security-about)
+- [Enable Safe Documents for Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-documents-in-e5-plus-security-about#use-the-microsoft-365-defender-portal-to-configure-safe-documents)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA234.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA234.ps1
new file mode 100644
index 000000000000..904c90d5f280
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA234.ps1
@@ -0,0 +1,35 @@
+function Invoke-CippTestORCA234 {
+    <#
+    .SYNOPSIS
+    Click through is disabled for Safe Documents
+    #>
+    param($Tenant)
+
+    try {
+        $AtpPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAtpPolicyForO365'
+
+        if (-not $AtpPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA234' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Click through is disabled for Safe Documents' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+            return
+        }
+
+        $Policy = $AtpPolicy | Select-Object -First 1
+
+        if ($Policy.AllowSafeDocsOpen -eq $false) {
+            $Status = 'Passed'
+            $Result = "Click through is disabled for Safe Documents.`n`n"
+            $Result += "**AllowSafeDocsOpen:** $($Policy.AllowSafeDocsOpen)"
+        } else {
+            $Status = 'Failed'
+            $Result = "Click through is enabled for Safe Documents.`n`n"
+            $Result += "**AllowSafeDocsOpen:** $($Policy.AllowSafeDocsOpen)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA234' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Click through is disabled for Safe Documents' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA234' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Click through is disabled for Safe Documents' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Attachments'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.md
new file mode 100644
index 000000000000..a88a52617782
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.md
@@ -0,0 +1,8 @@
+SPF (Sender Policy Framework) records should be configured for all custom domains to specify which mail servers are authorized to send email on behalf of your domain. Properly configured SPF records help prevent email spoofing and improve email deliverability by allowing receiving servers to verify that messages claiming to be from your domain actually originate from authorized sources.
+
+**Remediation action**
+
+- [Set up SPF to help prevent spoofing](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-spf-configure)
+- [Email authentication in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.ps1
new file mode 100644
index 000000000000..6d72efdf2bfe
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.ps1
@@ -0,0 +1,43 @@
+function Invoke-CippTestORCA235 {
+    <#
+    .SYNOPSIS
+    SPF records setup for custom domains
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA235' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'SPF records setup for custom domains' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Configuration'
+            return
+        }
+
+        # Note: This test would ideally check DNS SPF records
+        # Since we don't have DNS query capability here, we'll provide informational guidance
+
+        $CustomDomains = $AcceptedDomains | Where-Object { $_.DomainName -notlike '*.onmicrosoft.com' }
+
+        if ($CustomDomains.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No custom domains found. Only using onmicrosoft.com domain.`n`n"
+            $Result += "**Total Domains:** $($AcceptedDomains.Count)"
+        } else {
+            $Status = 'Informational'
+            $Result = "Found $($CustomDomains.Count) custom domains that should have SPF records configured.`n`n"
+            $Result += "**Custom Domains:**`n`n"
+            foreach ($Domain in $CustomDomains) {
+                $Result += "- $($Domain.DomainName)`n"
+            }
+            $Result += "`n**Action Required:** Verify that each custom domain has an SPF record including Microsoft 365:`n"
+            $Result += "``v=spf1 include:spf.protection.outlook.com -all``"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA235' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'SPF records setup for custom domains' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Configuration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA235' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'SPF records setup for custom domains' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Configuration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA236.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA236.md
new file mode 100644
index 000000000000..a07d9478c79a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA236.md
@@ -0,0 +1,8 @@
+Safe Links should be enabled for email messages to provide real-time URL scanning and protection against malicious links. When enabled, Safe Links rewrites URLs in email messages and checks them at click-time to detect and block malicious websites, protecting users from phishing attacks and malware delivery even if the link becomes malicious after the email was sent.
+
+**Remediation action**
+
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA236.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA236.ps1
new file mode 100644
index 000000000000..89f67a40f68f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA236.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA236 {
+    <#
+    .SYNOPSIS
+    Safe Links is enabled for emails
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA236' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe Links is enabled for emails' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableSafeLinksForEmail -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Links policies have email protection enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) Safe Links policies do not have email protection enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Safe Links For Email |`n"
+            $Result += "|------------|----------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableSafeLinksForEmail) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA236' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe Links is enabled for emails' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA236' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe Links is enabled for emails' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA237.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA237.md
new file mode 100644
index 000000000000..2c25114d3dcf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA237.md
@@ -0,0 +1,8 @@
+Safe Links should be enabled for Microsoft Teams to protect users from malicious URLs shared in Teams messages and channels. Enabling this protection ensures that links in Teams conversations are scanned and blocked if they lead to malicious sites, extending the same URL protection available in email to your collaboration platform.
+
+**Remediation action**
+
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA237.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA237.ps1
new file mode 100644
index 000000000000..5962ac11eb59
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA237.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA237 {
+    <#
+    .SYNOPSIS
+    Safe Links is enabled for Teams
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA237' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe Links is enabled for Teams' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableSafeLinksForTeams -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Links policies have Teams protection enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) Safe Links policies do not have Teams protection enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Safe Links For Teams |`n"
+            $Result += "|------------|----------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableSafeLinksForTeams) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA237' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe Links is enabled for Teams' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA237' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe Links is enabled for Teams' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA238.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA238.md
new file mode 100644
index 000000000000..948957dd91bd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA238.md
@@ -0,0 +1,8 @@
+Safe Links should be enabled for Office applications to protect users from malicious URLs in Office documents such as Word, Excel, and PowerPoint files. This protection extends URL scanning to documents opened in Office desktop, mobile, and web applications, helping prevent users from clicking malicious links embedded in documents.
+
+**Remediation action**
+
+- [Set up Safe Links policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-policies-configure)
+- [Safe Links in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/safe-links-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA238.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA238.ps1
new file mode 100644
index 000000000000..e4f3d35ac306
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA238.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA238 {
+    <#
+    .SYNOPSIS
+    Safe Links is enabled for Office documents
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA238' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Safe Links is enabled for Office documents' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableSafeLinksForOffice -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All Safe Links policies have Office document protection enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) Safe Links policies do not have Office document protection enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable Safe Links For Office |`n"
+            $Result += "|------------|------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableSafeLinksForOffice) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA238' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Safe Links is enabled for Office documents' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA238' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Safe Links is enabled for Office documents' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Safe Links'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA239.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA239.md
new file mode 100644
index 000000000000..29fde2255510
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA239.md
@@ -0,0 +1,9 @@
+Protection policies should not include exclusions or allow lists that bypass security controls. Adding senders or domains to exclusion lists creates security gaps that attackers can exploit to deliver malicious content without being detected. Even trusted partners can be compromised, so all email should go through security scanning.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA239.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA239.ps1
new file mode 100644
index 000000000000..24ccf3edcb1d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA239.ps1
@@ -0,0 +1,83 @@
+function Invoke-CippTestORCA239 {
+    <#
+    .SYNOPSIS
+    No exclusions for built-in protection
+    #>
+    param($Tenant)
+
+    try {
+        $AntiPhishPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+        $ContentFilterPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $AntiPhishPolicies -and -not $ContentFilterPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA239' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No policies found in database.' -Risk 'High' -Name 'No exclusions for built-in protection' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Configuration'
+            return
+        }
+
+        $FailedPolicies = @()
+        $Issues = @()
+
+        # Check Anti-Phish policies for exclusions
+        if ($AntiPhishPolicies) {
+            foreach ($Policy in $AntiPhishPolicies) {
+                $HasExclusions = $false
+                $ExclusionDetails = @()
+
+                if ($Policy.ExcludedSenders -and $Policy.ExcludedSenders.Count -gt 0) {
+                    $HasExclusions = $true
+                    $ExclusionDetails += "ExcludedSenders: $($Policy.ExcludedSenders.Count)"
+                }
+
+                if ($Policy.ExcludedDomains -and $Policy.ExcludedDomains.Count -gt 0) {
+                    $HasExclusions = $true
+                    $ExclusionDetails += "ExcludedDomains: $($Policy.ExcludedDomains.Count)"
+                }
+
+                if ($HasExclusions) {
+                    $Issues += "Anti-Phish Policy '$($Policy.Identity)': $($ExclusionDetails -join ', ')"
+                }
+            }
+        }
+
+        # Check Content Filter policies for exclusions
+        if ($ContentFilterPolicies) {
+            foreach ($Policy in $ContentFilterPolicies) {
+                $HasExclusions = $false
+                $ExclusionDetails = @()
+
+                if ($Policy.AllowedSenders -and $Policy.AllowedSenders.Count -gt 0) {
+                    $HasExclusions = $true
+                    $ExclusionDetails += "AllowedSenders: $($Policy.AllowedSenders.Count)"
+                }
+
+                if ($Policy.AllowedSenderDomains -and $Policy.AllowedSenderDomains.Count -gt 0) {
+                    $HasExclusions = $true
+                    $ExclusionDetails += "AllowedSenderDomains: $($Policy.AllowedSenderDomains.Count)"
+                }
+
+                if ($HasExclusions) {
+                    $Issues += "Anti-Spam Policy '$($Policy.Identity)': $($ExclusionDetails -join ', ')"
+                }
+            }
+        }
+
+        if ($Issues.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "No exclusions found in built-in protection policies."
+        } else {
+            $Status = 'Failed'
+            $Result = "Found $($Issues.Count) policies with exclusions that bypass built-in protection.`n`n"
+            $Result += "**Issues Found:**`n`n"
+            foreach ($Issue in $Issues) {
+                $Result += "- $Issue`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA239' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'No exclusions for built-in protection' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Configuration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA239' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'No exclusions for built-in protection' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Configuration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.md
new file mode 100644
index 000000000000..09b5ed1ccfc7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.md
@@ -0,0 +1,8 @@
+External sender identification should be enabled in Outlook to help users quickly identify messages from external senders. When configured, Outlook displays a visual indicator (such as "External" tags) on messages from outside the organization, helping users exercise appropriate caution when interacting with external content and reducing the risk of phishing attacks.
+
+**Remediation action**
+
+- [External sender callouts in Outlook](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-outbound-spam-about#external-sender-callouts)
+- [Configure organization relationships in Exchange Online](https://learn.microsoft.com/exchange/sharing/organization-relationships/organization-relationships)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.ps1
new file mode 100644
index 000000000000..d283d3a0c45b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.ps1
@@ -0,0 +1,35 @@
+function Invoke-CippTestORCA240 {
+    <#
+    .SYNOPSIS
+    Outlook external tags are configured
+    #>
+    param($Tenant)
+
+    try {
+        $OrgConfig = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoOrganizationConfig'
+
+        if (-not $OrgConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA240' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Outlook external tags are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Configuration'
+            return
+        }
+
+        $Config = $OrgConfig | Select-Object -First 1
+
+        if ($Config.ExternalInOutlook -ne 'Disabled') {
+            $Status = 'Passed'
+            $Result = "Outlook external tags are configured.`n`n"
+            $Result += "**ExternalInOutlook:** $($Config.ExternalInOutlook)"
+        } else {
+            $Status = 'Failed'
+            $Result = "Outlook external tags are NOT configured.`n`n"
+            $Result += "**ExternalInOutlook:** $($Config.ExternalInOutlook)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA240' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Outlook external tags are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Configuration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA240' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Outlook external tags are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Configuration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA241.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA241.md
new file mode 100644
index 000000000000..09875bcda233
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA241.md
@@ -0,0 +1,8 @@
+First Contact Safety Tips display warnings when users receive email from a sender for the first time. This feature helps users recognize potentially suspicious messages from unfamiliar senders, providing an opportunity to verify the sender's identity before responding or clicking links, especially useful for detecting spear-phishing attacks from new contacts.
+
+**Remediation action**
+
+- [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
+- [Safety tips in email messages in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-safety-tips-about)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA241.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA241.ps1
new file mode 100644
index 000000000000..8e5b26129d3e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA241.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA241 {
+    <#
+    .SYNOPSIS
+    First Contact Safety Tips is enabled
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA241' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'First Contact Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.EnableFirstContactSafetyTips -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-phishing policies have First Contact Safety Tips enabled.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-phishing policies do not have First Contact Safety Tips enabled.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Enable First Contact Safety Tips |`n"
+            $Result += "|------------|----------------------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.EnableFirstContactSafetyTips) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA241' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'First Contact Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA241' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'First Contact Safety Tips is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Phish'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.md
new file mode 100644
index 000000000000..19d786b500da
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.md
@@ -0,0 +1,8 @@
+Security alert policies should be configured to notify administrators of important protection events and potential security incidents. Alerts for events such as malware campaigns, suspicious email patterns, compromised accounts, and policy violations help security teams respond quickly to threats and maintain visibility into the effectiveness of email security controls.
+
+**Remediation action**
+
+- [Alert policies in the Microsoft 365 compliance center](https://learn.microsoft.com/microsoft-365/compliance/alert-policies)
+- [Get started with alert policies](https://learn.microsoft.com/purview/alert-policies)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.ps1
new file mode 100644
index 000000000000..ba691ddf939e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.ps1
@@ -0,0 +1,30 @@
+function Invoke-CippTestORCA242 {
+    <#
+    .SYNOPSIS
+    Important protection alerts enabled
+    #>
+    param($Tenant)
+
+    try {
+        # This test would check for alert policies related to ATP/Defender for Office 365
+        # Since we don't have an alert policy cache, we'll provide informational guidance
+
+        $Status = 'Informational'
+        $Result = "Alert policies for protection features should be enabled and monitored.`n`n"
+        $Result += "**Recommended Alert Policies:**`n`n"
+        $Result += "- Messages reported by users as malware or phish`n"
+        $Result += "- Email sending limit exceeded`n"
+        $Result += "- Suspicious email forwarding activity`n"
+        $Result += "- Malware campaign detected`n"
+        $Result += "- Suspicious connector activity`n"
+        $Result += "- Unusual external user file activity`n"
+        $Result += "`n**Action Required:** Verify alert policies are configured in Microsoft 365 Security & Compliance Center"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA242' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Important protection alerts enabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Configuration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA242' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Important protection alerts enabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Configuration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA243.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA243.md
new file mode 100644
index 000000000000..b24f602a85fd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA243.md
@@ -0,0 +1,8 @@
+Inbound connectors for non-authoritative domains should be configured with proper authentication to maintain the integrity of email security checks. When email flows through third-party services, connectors should specify authenticated source IPs or certificates to ensure that Exchange Online can properly validate sender information and apply appropriate security policies.
+
+**Remediation action**
+
+- [Configure mail flow using connectors in Exchange Online](https://learn.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow)
+- [Enhanced filtering for connectors in Exchange Online](https://learn.microsoft.com/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA243.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA243.ps1
new file mode 100644
index 000000000000..28a3717e845b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA243.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestORCA243 {
+    <#
+    .SYNOPSIS
+    Authenticated Receive Chain for non-EOP domains
+    #>
+    param($Tenant)
+
+    try {
+        $AcceptedDomains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
+
+        if (-not $AcceptedDomains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA243' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'Medium' -Name 'Authenticated Receive Chain for non-EOP domains' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Configuration'
+            return
+        }
+
+        # Check for non-authoritative domains that would need inbound connectors
+        $NonAuthDomains = $AcceptedDomains | Where-Object { $_.DomainType -in @('InternalRelay', 'ExternalRelay') }
+
+        if ($NonAuthDomains.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All domains are authoritative. No inbound connectors needed.`n`n"
+            $Result += "**Total Domains:** $($AcceptedDomains.Count)"
+        } else {
+            $Status = 'Informational'
+            $Result = "Found $($NonAuthDomains.Count) non-authoritative domains.`n`n"
+            $Result += "**Domains Requiring Inbound Connectors:**`n`n"
+            foreach ($Domain in $NonAuthDomains) {
+                $Result += "- $($Domain.DomainName) (Type: $($Domain.DomainType))`n"
+            }
+            $Result += "`n**Action Required:** Verify inbound connectors are configured with proper authentication for these domains"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA243' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Authenticated Receive Chain for non-EOP domains' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Configuration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA243' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Authenticated Receive Chain for non-EOP domains' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Configuration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.md b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.md
new file mode 100644
index 000000000000..51ed9d611bea
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.md
@@ -0,0 +1,8 @@
+Anti-spam policies should honor DMARC (Domain-based Message Authentication, Reporting, and Conformance) policies published by sending domains. When enabled, this setting respects the sender domain's DMARC policy for handling authentication failures, improving email security by enforcing the sender's preferred treatment of spoofed or forged messages.
+
+**Remediation action**
+
+- [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
+- [Use DMARC to validate email in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/email-authentication-dmarc-configure)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.ps1 b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.ps1
new file mode 100644
index 000000000000..177731b925e7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.ps1
@@ -0,0 +1,49 @@
+function Invoke-CippTestORCA244 {
+    <#
+    .SYNOPSIS
+    Policies honor sending domain DMARC
+    #>
+    param($Tenant)
+
+    try {
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+
+        if (-not $Policies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA244' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Policies honor sending domain DMARC' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+            return
+        }
+
+        $FailedPolicies = [System.Collections.Generic.List[object]]::new()
+        $PassedPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $Policies) {
+            if ($Policy.HonorDMARCPolicy -eq $true) {
+                $PassedPolicies.Add($Policy) | Out-Null
+            } else {
+                $FailedPolicies.Add($Policy) | Out-Null
+            }
+        }
+
+        if ($FailedPolicies.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All anti-spam policies honor sending domain DMARC.`n`n"
+            $Result += "**Compliant Policies:** $($PassedPolicies.Count)"
+        } else {
+            $Status = 'Failed'
+            $Result = "$($FailedPolicies.Count) anti-spam policies do not honor sending domain DMARC.`n`n"
+            $Result += "**Non-Compliant Policies:** $($FailedPolicies.Count)`n`n"
+            $Result += "| Policy Name | Honor DMARC Policy |`n"
+            $Result += "|------------|--------------------|`n"
+            foreach ($Policy in $FailedPolicies) {
+                $Result += "| $($Policy.Identity) | $($Policy.HonorDMARCPolicy) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA244' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Policies honor sending domain DMARC' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA244' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Policies honor sending domain DMARC' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Anti-Spam'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ORCA/report.json b/Modules/CIPPCore/Public/Tests/ORCA/report.json
new file mode 100644
index 000000000000..cb19336da0f5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ORCA/report.json
@@ -0,0 +1,77 @@
+{
+  "name": "ORCA (Office 365 Recommended Configuration Analyzer) Tests",
+  "description": "Comprehensive security assessment for Microsoft Exchange Online and Office 365 security configurations. Tests cover anti-spam, anti-phish, anti-malware, safe links, safe attachments, DKIM, transport rules, and other Exchange Online security settings.",
+  "version": "1.0",
+  "source": "https://github.com/maester365/maester",
+  "category": "Exchange Online Security",
+  "note": "ORCA tests require Exchange Online and Security & Compliance Center data. Many tests require custom ORCA framework classes and detailed implementation. Tests marked as requiring specific caches will be implemented based on available CIPP cache data.",
+  "IdentityTests": [
+    "ORCA100",
+    "ORCA101",
+    "ORCA102",
+    "ORCA103",
+    "ORCA104",
+    "ORCA105",
+    "ORCA106",
+    "ORCA107",
+    "ORCA108",
+    "ORCA1081",
+    "ORCA109",
+    "ORCA110",
+    "ORCA111",
+    "ORCA112",
+    "ORCA113",
+    "ORCA114",
+    "ORCA115",
+    "ORCA116",
+    "ORCA1181",
+    "ORCA1182",
+    "ORCA1183",
+    "ORCA1184",
+    "ORCA119",
+    "ORCA120malware",
+    "ORCA120phish",
+    "ORCA120spam",
+    "ORCA121",
+    "ORCA123",
+    "ORCA124",
+    "ORCA139",
+    "ORCA140",
+    "ORCA141",
+    "ORCA142",
+    "ORCA143",
+    "ORCA156",
+    "ORCA158",
+    "ORCA179",
+    "ORCA180",
+    "ORCA189",
+    "ORCA1892",
+    "ORCA205",
+    "ORCA220",
+    "ORCA221",
+    "ORCA222",
+    "ORCA223",
+    "ORCA224",
+    "ORCA225",
+    "ORCA226",
+    "ORCA227",
+    "ORCA228",
+    "ORCA229",
+    "ORCA230",
+    "ORCA231",
+    "ORCA232",
+    "ORCA233",
+    "ORCA2331",
+    "ORCA234",
+    "ORCA235",
+    "ORCA236",
+    "ORCA237",
+    "ORCA238",
+    "ORCA239",
+    "ORCA240",
+    "ORCA241",
+    "ORCA242",
+    "ORCA243",
+    "ORCA244"
+  ]
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24518.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24518.md
new file mode 100644
index 000000000000..99c5096fc32b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24518.md
@@ -0,0 +1,9 @@
+Without owners, enterprise applications become orphaned assets that threat actors can exploit through credential harvesting and privilege escalation techniques, as these applications often retain elevated permissions and access to sensitive resources while lacking proper oversight and security governance. The elevation of privilege to owners can raise a security concern in some cases depending on the application's permissions, but more critically, applications without owner create a blind spot in security monitoring where threat actors can establish persistence by leveraging existing application permissions to access data or create backdoor accounts without triggering ownership-based detection mechanisms. When applications lack owners, security teams cannot effectively conduct application lifecycle management, leaving applications with potentially excessive permissions, outdated configurations, or compromised credentials that threat actors can discover through enumeration techniques and exploit to move laterally within the environment. The absence of ownership also prevents proper access reviews and permission audits, allowing threat actors to maintain long-term access through applications that should have been decommissioned or had their permissions reduced, ultimately providing persistent access vectors that can be leveraged for data exfiltration or further compromise of the environment.
+
+
+**Remediation action**
+
+- [Assign owners to the application](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-app-owners?pivots=portal)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24540.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24540.md
new file mode 100644
index 000000000000..ac6dfafe2063
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24540.md
@@ -0,0 +1,18 @@
+If policies for Windows Firewall aren't configured and assigned, threat actors can exploit unprotected endpoints to gain unauthorized access, move laterally, and escalate privileges within the environment. Without enforced firewall rules, attackers can bypass network segmentation, exfiltrate data, or deploy malware, increasing the risk of widespread compromise.
+
+Enforcing Windows Firewall policies ensures consistent application of inbound and outbound traffic controls, reducing exposure to unauthorized access and supporting Zero Trust through network segmentation and device-level protection.
+
+**Remediation action**
+
+Configure and assign firewall policies for Windows in Intune to block unauthorized traffic and enforce consistent network protections across all managed devices:
+
+- [Configure firewall policies for Windows devices](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-firewall-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci). Intune uses two complementary profiles to manage firewall settings:
+  - **Windows Firewall** - Use this profile to configure overall firewall behavior based on network type.
+  - **Windows Firewall rules** - Use this profile to define traffic rules for apps, ports, or IPs, tailored to specific groups or workloads. This Intune profile also supports use of [reusable settings groups](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-firewall-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#add-reusable-settings-groups-to-profiles-for-firewall-rules) to help simplify management of common settings you use for different profile instances.
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
+
+For more information, see:  
+- [Available Windows Firewall settings](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-firewall-profile-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#windows-firewall-profile)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24540.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24540.ps1
new file mode 100644
index 000000000000..40e130efdae4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24540.ps1
@@ -0,0 +1,72 @@
+function Invoke-CippTestZTNA24540 {
+    <#
+    .SYNOPSIS
+    Windows Firewall policies protect against unauthorized network access
+    #>
+    param($Tenant)
+    #Tested - Device
+    try {
+        $ConfigurationPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigurationPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $FirewallPolicies = $ConfigurationPolicies | Where-Object {
+            $_.templateReference -and $_.templateReference.templateFamily -eq 'endpointSecurityFirewall'
+        }
+
+        if ($FirewallPolicies.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Windows Firewall configuration policies found' -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $AssignedPolicies = $FirewallPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedPolicies.Count -gt 0) {
+            $Status = 'Passed'
+            $ResultLines = @(
+                'At least one Windows Firewall policy is created and assigned to a group.'
+                ''
+                '**Windows Firewall Configuration Policies:**'
+                ''
+                '| Policy Name | Status | Assignment Count |'
+                '| :---------- | :----- | :--------------- |'
+            )
+
+            foreach ($Policy in $FirewallPolicies) {
+                $PolicyStatus = if ($Policy.assignments -and $Policy.assignments.Count -gt 0) {
+                    '✅ Assigned'
+                } else {
+                    '❌ Not assigned'
+                }
+                $AssignmentCount = if ($Policy.assignments) { $Policy.assignments.Count } else { 0 }
+                $ResultLines += "| $($Policy.name) | $PolicyStatus | $AssignmentCount |"
+            }
+
+            $Result = $ResultLines -join "`n"
+        } else {
+            $Status = 'Failed'
+            $ResultLines = @(
+                'There are no firewall policies assigned to any groups.'
+                ''
+                '**Windows Firewall Configuration Policies (Unassigned):**'
+                ''
+            )
+
+            foreach ($Policy in $FirewallPolicies) {
+                $ResultLines += "- $($Policy.name)"
+            }
+
+            $Result = $ResultLines -join "`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24540' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Windows Firewall policies protect against unauthorized network access' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24541.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24541.md
new file mode 100644
index 000000000000..38309e2747a4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24541.md
@@ -0,0 +1,11 @@
+If compliance policies for Windows devices aren't configured and assigned, threat actors can exploit unmanaged or noncompliant endpoints to gain unauthorized access to corporate resources, bypass security controls, and persist within the environment. Without enforced compliance, devices can lack critical security configurations like BitLocker encryption, password requirements, firewall settings, and OS version controls. These gaps increase the risk of data leakage, privilege escalation, and lateral movement. Inconsistent device compliance weakens the organization’s security posture and makes it harder to detect and remediate threats before significant damage occurs.
+
+Enforcing compliance policies ensures Windows devices meet core security requirements and supports Zero Trust by validating device health and reducing exposure to misconfigured endpoints.
+
+**Remediation action**
+
+Create and assign Intune compliance policies to Windows devices to enforce organizational standards for secure access and management:
+- [Create and assign Intune compliance policies](https://learn.microsoft.com/intune/intune-service/protect/create-compliance-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-policy)
+- [Review the Windows compliance settings you can manage with Intune](https://learn.microsoft.com/intune/intune-service/protect/compliance-policy-create-windows?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24541.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24541.ps1
new file mode 100644
index 000000000000..acf03ea73a68
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24541.ps1
@@ -0,0 +1,48 @@
+function Invoke-CippTestZTNA24541 {
+    <#
+    .SYNOPSIS
+    Compliance policies protect Windows devices
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24541'
+    #Tested - Device
+    try {
+        $IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceCompliancePolicies'
+
+        if (-not $IntunePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Compliance policies protect Windows devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $WindowsPolicies = @($IntunePolicies | Where-Object {
+                $_.'@odata.type' -in @('#microsoft.graph.windows10CompliancePolicy', '#microsoft.graph.windows11CompliancePolicy')
+            })
+
+        $AssignedPolicies = @($WindowsPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one Windows compliance policy exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No Windows compliance policy exists or none are assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## Windows Compliance Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :------- |`n"
+
+        foreach ($policy in $WindowsPolicies) {
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect Windows devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect Windows devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24542.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24542.md
new file mode 100644
index 000000000000..9f2fc9e48eb8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24542.md
@@ -0,0 +1,12 @@
+If compliance policies for macOS devices aren't configured and assigned, threat actors can exploit unmanaged or noncompliant endpoints to gain unauthorized access to corporate resources, bypass security controls, and persist within the environment. Without enforced compliance, macOS devices can lack critical security configurations like data storage encryption, password requirements, and OS version controls. These gaps increase the risk of data leakage, privilege escalation, and lateral movement. Inconsistent device compliance weakens the organization’s security posture and makes it harder to detect and remediate threats before significant damage occurs.
+
+Enforcing compliance policies ensures macOS devices meet core security requirements and supports Zero Trust by validating device health and reducing exposure to misconfigured endpoints.
+
+**Remediation actions**
+
+Create and assign Intune compliance policies to macOS devices to enforce organizational standards for secure access and management:  
+- [Create and assign Intune compliance policies](https://learn.microsoft.com/intune/intune-service/protect/create-compliance-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-policy)
+- [Review the macOS compliance settings you can manage with Intune](https://learn.microsoft.com/intune/intune-service/protect/compliance-policy-create-mac-os?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24542.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24542.ps1
new file mode 100644
index 000000000000..81215ce30efa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24542.ps1
@@ -0,0 +1,45 @@
+function Invoke-CippTestZTNA24542 {
+    <#
+    .SYNOPSIS
+    Compliance policies protect macOS devices
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24542'
+    #Tested - Device
+    try {
+        $IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceCompliancePolicies'
+
+        if (-not $IntunePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Compliance policies protect macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $MacOSPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.macOSCompliancePolicy' })
+        $AssignedPolicies = @($MacOSPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one macOS compliance policy exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No macOS compliance policy exists or none are assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## macOS Compliance Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :------- |`n"
+
+        foreach ($policy in $MacOSPolicies) {
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24543.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24543.md
new file mode 100644
index 000000000000..cc5957a9245a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24543.md
@@ -0,0 +1,12 @@
+If compliance policies aren't assigned to iOS/iPadOS devices in Intune, threat actors can exploit noncompliant endpoints to gain unauthorized access to corporate resources, bypass security controls, and persist in the environment. Without enforced compliance, devices can lack critical security configurations like passcode requirements and OS version controls. These gaps increase the risk of data leakage, privilege escalation, and lateral movement. Inconsistent device compliance weakens the organization’s security posture and makes it harder to detect and remediate threats before significant damage occurs.
+
+Enforcing compliance policies ensures iOS/iPadOS devices meet core security requirements and supports Zero Trust by validating device health and reducing exposure to misconfigured or unmanaged endpoints.
+
+**Remediation action**
+
+Create and assign Intune compliance policies to iOS/iPadOS devices to enforce organizational standards for secure access and management:  
+- [Create a compliance policy in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/protect/create-compliance-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-policy)
+- [Review the iOS/iPadOS compliance settings you can manage with Intune](https://learn.microsoft.com/intune/intune-service/protect/compliance-policy-create-ios?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24543.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24543.ps1
new file mode 100644
index 000000000000..3130d6e531fa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24543.ps1
@@ -0,0 +1,46 @@
+function Invoke-CippTestZTNA24543 {
+    <#
+    .SYNOPSIS
+    Compliance policies protect iOS/iPadOS devices
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24543'
+    #Tested - Device
+
+    try {
+        $IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceCompliancePolicies'
+
+        if (-not $IntunePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Compliance policies protect iOS/iPadOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $iOSPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.iosCompliancePolicy' })
+        $AssignedPolicies = @($iOSPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one iOS/iPadOS compliance policy exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No iOS/iPadOS compliance policy exists or none are assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## iOS/iPadOS Compliance Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :------- |`n"
+
+        foreach ($policy in $iOSPolicies) {
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect iOS/iPadOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect iOS/iPadOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24545.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24545.md
new file mode 100644
index 000000000000..7f319eaf0e79
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24545.md
@@ -0,0 +1,11 @@
+If compliance policies aren't assigned to fully managed Android Enterprise devices in Intune, threat actors can exploit noncompliant endpoints to gain unauthorized access to corporate resources, bypass security controls, and persist in the environment. Without enforced compliance, devices can lack critical security configurations such as passcode requirements, data storage encryption, and OS version controls. These gaps increase the risk of data leakage, privilege escalation, and lateral movement. Inconsistent device compliance weakens the organization’s security posture and makes it harder to detect and remediate threats before significant damage occurs.
+
+Enforcing compliance policies ensures Android Enterprise devices meet core security requirements and supports Zero Trust by validating device health and reducing exposure to misconfigured or unmanaged endpoints.
+
+**Remediation action**
+
+Create and assign Intune compliance policies to fully managed and corporate-owned Android Enterprise devices to enforce organizational standards for secure access and management:  
+- [Create a compliance policy in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/protect/create-compliance-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-policy)
+- [Review the Android Enterprise compliance settings you can manage with Intune](https://learn.microsoft.com/intune/intune-service/protect/compliance-policy-create-android-for-work?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24545.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24545.ps1
new file mode 100644
index 000000000000..c40f080a415b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24545.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestZTNA24545 {
+    <#
+    .SYNOPSIS
+    Compliance policies protect fully managed and corporate-owned Android devices
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24545'
+    #Tested - Device
+
+    try {
+        $IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceCompliancePolicies'
+
+        if (-not $IntunePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Compliance policies protect fully managed and corporate-owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $AndroidPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.androidDeviceOwnerCompliancePolicy' })
+        $AssignedPolicies = @($AndroidPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one compliance policy for Android Enterprise Fully managed devices exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No compliance policy for Android Enterprise exists or none are assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## Android Device Owner Compliance Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :------- |`n"
+
+        foreach ($policy in $AndroidPolicies) {
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect fully managed and corporate-owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect fully managed and corporate-owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24546.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24546.md
new file mode 100644
index 000000000000..6f28c5111ac9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24546.md
@@ -0,0 +1,14 @@
+If Windows automatic enrollment isn't enabled, unmanaged devices can become an entry point for attackers. Threat actors might use these devices to access corporate data, bypass compliance policies, and introduce vulnerabilities into the environment. Devices joined to Microsoft Entra without Intune enrollment create gaps in visibility and control. These unmanaged endpoints can expose weaknesses in the operating system or misconfigured applications that attackers can exploit.
+
+Enforcing automatic enrollment ensures Windows devices are managed from the start, enabling consistent policy enforcement and visibility into compliance. This supports Zero Trust by ensuring all devices are verified, monitored, and governed by security controls.
+
+**Remediation action**
+
+Enable automatic enrollment for Windows devices using Intune and Microsoft Entra to ensure all domain-joined or Entra-joined devices are managed:  
+- [Enable Windows automatic enrollment](https://learn.microsoft.com/intune/intune-service/enrollment/windows-enroll?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-windows-automatic-enrollment)
+
+For more information, see:  
+- [Deployment guide - Enrollment for Windows](https://learn.microsoft.com/intune/intune-service/fundamentals/deployment-guide-enroll?tabs=work-profile%2Ccorporate-owned-apple%2Cautomatic-enrollment&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enrollment-for-windows)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24547.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24547.md
new file mode 100644
index 000000000000..3aaa5280e921
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24547.md
@@ -0,0 +1,12 @@
+If compliance policies aren't assigned to Android Enterprise personally owned devices in Intune, threat actors can exploit noncompliant endpoints to gain unauthorized access to corporate resources, bypass security controls, and introduce vulnerabilities. Without enforced compliance, devices can lack critical security configurations like passcode requirements, data storage encryption, and OS version controls. These gaps increase the risk of data leakage and unauthorized access. Inconsistent device compliance weakens the organization’s security posture and makes it harder to detect and remediate threats before significant damage occurs.
+
+Enforcing compliance policies ensures that personally owned Android devices meet core security requirements and supports Zero Trust by validating device health and reducing exposure to misconfigured or unmanaged endpoints.
+
+**Remediation action**
+
+Create and assign Intune compliance policies to Android Enterprise personally owned devices to enforce organizational standards for secure access and management:  
+- [Create a compliance policy in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/protect/create-compliance-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-policy)
+- [Review the Android Enterprise compliance settings you can manage with Intune](https://learn.microsoft.com/intune/intune-service/protect/compliance-policy-create-android-for-work?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24547.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24547.ps1
new file mode 100644
index 000000000000..e1ede894c0c1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24547.ps1
@@ -0,0 +1,47 @@
+function Invoke-CippTestZTNA24547 {
+    <#
+    .SYNOPSIS
+    Compliance policies protect personally owned Android devices
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24547'
+    #Tested - Device
+
+    try {
+        $IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceCompliancePolicies'
+
+        if (-not $IntunePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Compliance policies protect personally owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $AndroidPolicies = @($IntunePolicies | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.androidWorkProfileCompliancePolicy' })
+        $AssignedPolicies = @($AndroidPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one compliance policy for Android Work Profile devices exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No compliance policy for Android Work Profile exists or none are assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## Android Work Profile Compliance Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :------- |`n"
+
+        foreach ($policy in $AndroidPolicies) {
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Compliance policies protect personally owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Compliance policies protect personally owned Android devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.md
new file mode 100644
index 000000000000..dae6ea117f95
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.md
@@ -0,0 +1,14 @@
+Without app protection policies, corporate data accessed on iOS/iPadOS devices is vulnerable to leakage through unmanaged or personal apps. Users can unintentionally copy sensitive information into unsecured apps, store data outside corporate boundaries, or bypass authentication controls. This risk is especially high on BYOD devices, where personal and work contexts coexist, increasing the likelihood of data exfiltration or unauthorized access.
+
+App protection policies ensure corporate data remains secure within approved apps, even on personal devices. These policies enforce encryption, restrict data sharing, and require authentication, reducing the risk of data leakage and aligning with Zero Trust principles of data protection and conditional access.
+ 
+**Remediation action**
+
+Deploy Intune app protection policies that encrypt corporate data, restrict sharing, and require authentication in approved iOS/iPadOS apps:  
+- [Deploy Intune app protection policies](https://learn.microsoft.com/intune/intune-service/apps/app-protection-policies?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-an-iosipados-or-android-app-protection-policy)
+- [Review the iOS app protection settings reference](https://learn.microsoft.com/intune/intune-service/apps/app-protection-policy-settings-ios?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+For more information, see:  
+- [Learn about using app protection policies](https://learn.microsoft.com/intune/intune-service/apps/app-protection-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1
new file mode 100644
index 000000000000..35d55fc52c15
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24548.ps1
@@ -0,0 +1,45 @@
+function Invoke-CippTestZTNA24548 {
+    <#
+    .SYNOPSIS
+    Data on iOS/iPadOS is protected by app protection policies
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24548'
+    #Tested - Device
+
+    try {
+        $IosPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneIosAppProtectionPolicies'
+
+        if (-not $IosPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $AssignedPolicies = @($IosPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one iOS app protection policy exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No iOS app protection policy exists or none are assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## iOS App Protection Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :------- |`n"
+
+        foreach ($policy in $IosPolicies) {
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on iOS/iPadOS is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.md
new file mode 100644
index 000000000000..2c0db7f420e3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.md
@@ -0,0 +1,16 @@
+Without app protection policies, corporate data accessed on Android devices is vulnerable to leakage through unmanaged or malicious apps. Users can unintentionally copy sensitive information into personal apps, store data insecurely, or bypass authentication controls. This risk is amplified on devices that aren't fully managed, where corporate and personal contexts coexist, increasing the likelihood of data exfiltration or unauthorized access.
+
+Enforcing app protection policies ensures that corporate data is only accessible through trusted apps and remains protected even on personal or BYOD Android devices.
+
+These policies enforce encryption, restrict data sharing, and require authentication, reducing the risk of data leakage and aligning with Zero Trust principles of data protection and Conditional Access.
+
+**Remediation action**
+
+Deploy Intune app protection policies that encrypt data, restrict sharing, and require authentication in approved Android apps:  
+- [Deploy Intune app protection policies](https://learn.microsoft.com/intune/intune-service/apps/app-protection-policies?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-an-iosipados-or-android-app-protection-policy)
+- [Review the Android app protection settings reference](https://learn.microsoft.com/intune/intune-service/apps/app-protection-policy-settings-android?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+For more information, see:  
+- [Learn about using app protection policies](https://learn.microsoft.com/intune/intune-service/apps/app-protection-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1
new file mode 100644
index 000000000000..93ec5e0072d1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24549.ps1
@@ -0,0 +1,45 @@
+function Invoke-CippTestZTNA24549 {
+    <#
+    .SYNOPSIS
+    Data on Android is protected by app protection policies
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24549'
+    #Tested - Device
+
+    try {
+        $AndroidPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneAndroidAppProtectionPolicies'
+
+        if (-not $AndroidPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $AssignedPolicies = @($AndroidPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one Android app protection policy exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No Android app protection policy exists or none are assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## Android App Protection Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :------- |`n"
+
+        foreach ($policy in $AndroidPolicies) {
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on Android is protected by app protection policies' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24550.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24550.md
new file mode 100644
index 000000000000..69fd867841a0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24550.md
@@ -0,0 +1,12 @@
+Without a properly configured and assigned BitLocker policy in Intune, threat actors can exploit unencrypted Windows devices to gain unauthorized access to sensitive corporate data. Devices that lack enforced encryption are vulnerable to physical attacks, like disk removal or booting from external media, allowing attackers to bypass operating system security controls. These attacks can result in data exfiltration, credential theft, and further lateral movement within the environment.
+
+Enforcing BitLocker across managed Windows devices is critical for compliance with data protection regulations and for reducing the risk of data breaches.
+
+**Remediation action**
+
+Use Intune to enforce BitLocker encryption and monitor compliance across all managed Windows devices:  
+- [Create a BitLocker policy for Windows devices in Intune](https://learn.microsoft.com/intune/intune-service/protect/encrypt-devices?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-and-deploy-policy)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
+- [Monitor device encryption with Intune](https://learn.microsoft.com/intune/intune-service/protect/encryption-monitor?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24550.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24550.ps1
new file mode 100644
index 000000000000..46c285740cb6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24550.ps1
@@ -0,0 +1,94 @@
+function Invoke-CippTestZTNA24550 {
+    <#
+    .SYNOPSIS
+    Data on Windows is protected by BitLocker encryption
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigurationPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigurationPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24550' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Data on Windows is protected by BitLocker encryption' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $WindowsPolicies = $ConfigurationPolicies | Where-Object {
+            $_.platforms -match 'windows10'
+        }
+
+        $WindowsBitLockerPolicies = @()
+        foreach ($WindowsPolicy in $WindowsPolicies) {
+            $ValidSettingValues = @('device_vendor_msft_bitlocker_requiredeviceencryption_1')
+
+            if ($WindowsPolicy.settings.settinginstance.choicesettingvalue.value) {
+                $PolicySettingValues = $WindowsPolicy.settings.settinginstance.choicesettingvalue.value
+                if ($PolicySettingValues -isnot [array]) {
+                    $PolicySettingValues = @($PolicySettingValues)
+                }
+
+                $HasValidSetting = $false
+                foreach ($SettingValue in $PolicySettingValues) {
+                    if ($ValidSettingValues -contains $SettingValue) {
+                        $HasValidSetting = $true
+                        break
+                    }
+                }
+
+                if ($HasValidSetting) {
+                    $WindowsBitLockerPolicies += $WindowsPolicy
+                }
+            }
+        }
+
+        $AssignedPolicies = $WindowsBitLockerPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedPolicies.Count -gt 0) {
+            $Status = 'Passed'
+            $ResultLines = @(
+                'At least one Windows BitLocker policy is configured and assigned.'
+                ''
+                '**Windows BitLocker Policies:**'
+                ''
+                '| Policy Name | Status | Assignment Count |'
+                '| :---------- | :----- | :--------------- |'
+            )
+
+            foreach ($Policy in $WindowsBitLockerPolicies) {
+                $PolicyStatus = if ($Policy.assignments -and $Policy.assignments.Count -gt 0) {
+                    '✅ Assigned'
+                } else {
+                    '❌ Not assigned'
+                }
+                $AssignmentCount = if ($Policy.assignments) { $Policy.assignments.Count } else { 0 }
+                $ResultLines += "| $($Policy.name) | $PolicyStatus | $AssignmentCount |"
+            }
+
+            $Result = $ResultLines -join "`n"
+        } else {
+            $Status = 'Failed'
+            if ($WindowsBitLockerPolicies.Count -gt 0) {
+                $ResultLines = @(
+                    'Windows BitLocker policies exist but none are assigned.'
+                    ''
+                    '**Unassigned BitLocker Policies:**'
+                    ''
+                )
+                foreach ($Policy in $WindowsBitLockerPolicies) {
+                    $ResultLines += "- $($Policy.name)"
+                }
+            } else {
+                $ResultLines = @('No Windows BitLocker policy is configured or assigned.')
+            }
+            $Result = $ResultLines -join "`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24550' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Data on Windows is protected by BitLocker encryption' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24550' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on Windows is protected by BitLocker encryption' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24551.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24551.md
new file mode 100644
index 000000000000..441a4d65d1a1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24551.md
@@ -0,0 +1,11 @@
+If policies for Windows Hello for Business (WHfB) aren't configured and assigned to all users and devices, threat actors can exploit weak authentication mechanisms—like passwords—to gain unauthorized access. This can lead to credential theft, privilege escalation, and lateral movement within the environment. Without strong, policy-driven authentication like WHfB, attackers can compromise devices and accounts, increasing the risk of widespread impact.
+
+Enforcing WHfB disrupts this attack chain by requiring strong, multifactor authentication, which helps reduce the risk of credential-based attacks and unauthorized access.
+
+**Remediation action**
+
+Deploy Windows Hello for Business in Intune to enforce strong, multifactor authentication:  
+- [Configure a tenant-wide Windows Hello for Business policy](https://learn.microsoft.com/intune/intune-service/protect/windows-hello?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-a-windows-hello-for-business-policy-for-device-enrollment) that applies at the time a device enrolls with Intune.
+- After enrollment, [configure Account protection profiles](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-account-protection-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#account-protection-profiles) and [assign](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups) different configurations for Windows Hello for Business to different groups of users and devices. <!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24552.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24552.md
new file mode 100644
index 000000000000..47161b346847
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24552.md
@@ -0,0 +1,15 @@
+Without a centrally managed firewall policy, macOS devices might rely on default or user-modified settings, which often fail to meet corporate security standards. This exposes devices to unsolicited inbound connections, enabling threat actors to exploit vulnerabilities, establish outbound command-and-control (C2) traffic for data exfiltration, and move laterally within the network—significantly escalating the scope and impact of a breach.
+
+Enforcing macOS Firewall policies ensures consistent control over inbound and outbound traffic, reducing exposure to unauthorized access and supporting Zero Trust through device-level protection and network segmentation.
+
+**Remediation action**
+
+Configure and assign **macOS Firewall** profiles in Intune to block unauthorized traffic and enforce consistent network protections across all managed macOS devices:
+
+- [Configure the built-in firewall on macOS devices](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-firewall-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
+
+For more information, see:  
+-  [Available macOS firewall settings](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-firewall-profile-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#macos-firewall-profile)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24552.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24552.ps1
new file mode 100644
index 000000000000..2d87afc2142b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24552.ps1
@@ -0,0 +1,94 @@
+function Invoke-CippTestZTNA24552 {
+    <#
+    .SYNOPSIS
+    Data on macOS is protected by firewall
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigurationPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigurationPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24552' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Data on macOS is protected by firewall' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $MacOSPolicies = $ConfigurationPolicies | Where-Object {
+            $_.platforms -match 'macOS'
+        }
+
+        $MacOSFirewallPolicies = @()
+        foreach ($MacOSPolicy in $MacOSPolicies) {
+            $ValidSettingValues = @('com.apple.security.firewall_enablefirewall_true')
+
+            if ($MacOSPolicy.settings.settinginstance.choicesettingvalue.value) {
+                $PolicySettingValues = $MacOSPolicy.settings.settinginstance.choicesettingvalue.value
+                if ($PolicySettingValues -isnot [array]) {
+                    $PolicySettingValues = @($PolicySettingValues)
+                }
+
+                $HasValidSetting = $false
+                foreach ($SettingValue in $PolicySettingValues) {
+                    if ($ValidSettingValues -contains $SettingValue) {
+                        $HasValidSetting = $true
+                        break
+                    }
+                }
+
+                if ($HasValidSetting) {
+                    $MacOSFirewallPolicies += $MacOSPolicy
+                }
+            }
+        }
+
+        $AssignedPolicies = $MacOSFirewallPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedPolicies.Count -gt 0) {
+            $Status = 'Passed'
+            $ResultLines = @(
+                'At least one macOS Firewall policy is configured and assigned.'
+                ''
+                '**macOS Firewall Policies:**'
+                ''
+                '| Policy Name | Status | Assignment Count |'
+                '| :---------- | :----- | :--------------- |'
+            )
+
+            foreach ($Policy in $MacOSFirewallPolicies) {
+                $PolicyStatus = if ($Policy.assignments -and $Policy.assignments.Count -gt 0) {
+                    '✅ Assigned'
+                } else {
+                    '❌ Not assigned'
+                }
+                $AssignmentCount = if ($Policy.assignments) { $Policy.assignments.Count } else { 0 }
+                $ResultLines += "| $($Policy.name) | $PolicyStatus | $AssignmentCount |"
+            }
+
+            $Result = $ResultLines -join "`n"
+        } else {
+            $Status = 'Failed'
+            if ($MacOSFirewallPolicies.Count -gt 0) {
+                $ResultLines = @(
+                    'macOS Firewall policies exist but none are assigned.'
+                    ''
+                    '**Unassigned Firewall Policies:**'
+                    ''
+                )
+                foreach ($Policy in $MacOSFirewallPolicies) {
+                    $ResultLines += "- $($Policy.name)"
+                }
+            } else {
+                $ResultLines = @('No macOS Firewall policy is configured or assigned.')
+            }
+            $Result = $ResultLines -join "`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24552' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Data on macOS is protected by firewall' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24552' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Data on macOS is protected by firewall' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24553.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24553.md
new file mode 100644
index 000000000000..23dcce5aa180
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24553.md
@@ -0,0 +1,16 @@
+If Windows Update policies aren't enforced across all corporate Windows devices, threat actors can exploit unpatched vulnerabilities to gain unauthorized access, escalate privileges, and move laterally within the environment. The attack chain often begins with device compromise via phishing, malware, or exploitation of known vulnerabilities, and is followed by attempts to bypass security controls. Without enforced update policies, attackers leverage outdated software to persist in the environment, increasing the risk of privilege escalation and domain-wide compromise.
+
+Enforcing Windows Update policies ensures timely patching of security flaws, disrupting attacker persistence, and reducing the risk of widespread compromise.
+
+**Remediation action**
+
+Start with [Manage Windows software updates in Intune](https://learn.microsoft.com/intune/intune-service/protect/windows-update-for-business-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to understand the available Windows Update policy types and how to configure them.
+
+Intune includes the following Windows update policy type: 
+- [Windows quality updates policy](https://learn.microsoft.com/intune/intune-service/protect/windows-quality-update-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to install the regular monthly updates for Windows.*
+- [Expedite updates policy](https://learn.microsoft.com/intune/intune-service/protect/windows-10-expedite-updates?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to quickly install critical security patches.*
+- [Feature updates policy](https://learn.microsoft.com/intune/intune-service/protect/windows-10-feature-updates?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Update rings policy](https://learn.microsoft.com/intune/intune-service/protect/windows-10-update-rings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to manage how and when devices install feature and quality updates.*
+- [Windows driver updates](https://learn.microsoft.com/intune/intune-service/protect/windows-driver-updates-overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) - *to update hardware components.*
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24553.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24553.ps1
new file mode 100644
index 000000000000..befe29a27e39
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24553.ps1
@@ -0,0 +1,53 @@
+function Invoke-CippTestZTNA24553 {
+    <#
+    .SYNOPSIS
+    Windows Update policies are enforced to reduce risk from unpatched vulnerabilities
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    $TestId = 'ZTNA24553'
+
+    try {
+        $IntunePolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceCompliancePolicies'
+
+        if (-not $IntunePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Windows Update policies are enforced to reduce risk from unpatched vulnerabilities' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $UpdatePolicies = @($IntunePolicies | Where-Object {
+                $_.'@odata.type' -in @(
+                    '#microsoft.graph.windowsUpdateForBusinessConfiguration',
+                    '#microsoft.graph.windows10CompliancePolicy'
+                )
+            })
+
+        $AssignedPolicies = @($UpdatePolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ Windows Update policies are configured and assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No Windows Update policies are configured or assigned.`n`n"
+        }
+
+        $ResultMarkdown += "## Windows Update Policies`n`n"
+        $ResultMarkdown += "| Policy Name | Type | Assigned |`n"
+        $ResultMarkdown += "| :---------- | :--- | :------- |`n"
+
+        foreach ($policy in $UpdatePolicies) {
+            $type = if ($policy.'@odata.type' -eq '#microsoft.graph.windowsUpdateForBusinessConfiguration') { 'Update' } else { 'Compliance' }
+            $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+            $ResultMarkdown += "| $($policy.displayName) | $type | $assigned |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Windows Update policies are enforced to reduce risk from unpatched vulnerabilities' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Windows Update policies are enforced to reduce risk from unpatched vulnerabilities' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24554.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24554.md
new file mode 100644
index 000000000000..780d3db02237
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24554.md
@@ -0,0 +1,11 @@
+If iOS update policies aren’t configured and assigned, threat actors can exploit unpatched vulnerabilities in outdated operating systems on managed devices. The absence of enforced update policies allows attackers to use known exploits to gain initial access, escalate privileges, and move laterally within the environment. Without timely updates, devices remain susceptible to exploits that have already been addressed by Apple, enabling threat actors to bypass security controls, deploy malware, or exfiltrate sensitive data. This attack chain begins with device compromise through an unpatched vulnerability, followed by persistence and potential data breach that impacts both organizational security and compliance posture.
+
+Enforcing update policies disrupts this chain by ensuring devices are consistently protected against known threats.
+
+**Remediation action**
+
+Configure and assign iOS/iPadOS update policies in Intune to enforce timely patching and reduce risk from unpatched vulnerabilities:  
+- [Manage iOS/iPadOS software updates in Intune](https://learn.microsoft.com/intune/intune-service/protect/software-updates-guide-ios-ipados?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24555.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24555.md
new file mode 100644
index 000000000000..9419a8e0b59d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24555.md
@@ -0,0 +1,12 @@
+If Intune scope tags aren't properly configured for delegated administration, attackers who gain privileged access to Intune or Microsoft Entra ID can escalate privileges and access sensitive device configurations across the tenant. Without granular scope tags, administrative boundaries are unclear, allowing attackers to move laterally, manipulate device policies, exfiltrate configuration data, or deploy malicious settings to all users and devices. A single compromised admin account can impact the entire environment. The absence of delegated administration also undermines least-privileged access, making it difficult to contain breaches and enforce accountability. Attackers might exploit global administrator roles or misconfigured role-based access control (RBAC) assignments to bypass compliance policies and gain broad control over device management.
+
+Enforcing scope tags segments administrative access and aligns it with organizational boundaries. This limits the blast radius of compromised accounts, supports least-privilege access, and aligns with Zero Trust principles of segmentation, role-based control, and containment.
+
+**Remediation action**
+
+Use Intune scope tags and RBAC roles to limit admin access based on role, geography, or business unit:  
+- [Learn how to create and deploy scope tags for distributed IT](https://learn.microsoft.com/intune/intune-service/fundamentals/scope-tags?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Implement role-based access control with Microsoft Intune](https://learn.microsoft.com/intune/intune-service/fundamentals/role-based-access-control?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24560.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24560.md
new file mode 100644
index 000000000000..2e5273c0032d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24560.md
@@ -0,0 +1,14 @@
+Without enforcing Local Administrator Password Solution (LAPS) policies, threat actors who gain access to endpoints can exploit static or weak local administrator passwords to escalate privileges, move laterally, and establish persistence. The attack chain typically begins with device compromise—via phishing, malware, or physical access—followed by attempts to harvest local admin credentials. Without LAPS, attackers can reuse compromised credentials across multiple devices, increasing the risk of privilege escalation and domain-wide compromise.
+
+Enforcing Windows LAPS on all corporate Windows devices ensures unique, regularly rotated local administrator passwords. This disrupts the attack chain at the credential access and lateral movement stages, significantly reducing the risk of widespread compromise.
+
+**Remediation action**
+
+Use Intune to enforce Windows LAPS policies that rotate strong and unique local admin passwords, and that back them up securely:  
+- [Deploy Windows LAPS policy with Microsoft Intune](https://learn.microsoft.com/intune/intune-service/protect/windows-laps-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-a-laps-policy)
+
+For more information, see:  
+- [Windows LAPS policy settings reference](https://learn.microsoft.com/windows-server/identity/laps/laps-management-policy-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Learn about Intune support for Windows LAPS](https://learn.microsoft.com/intune/intune-service/protect/windows-laps-overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24560.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24560.ps1
new file mode 100644
index 000000000000..0df6b175853d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24560.ps1
@@ -0,0 +1,71 @@
+function Invoke-CippTestZTNA24560 {
+    <#
+    .SYNOPSIS
+    Local administrator credentials on Windows are protected by Windows LAPS
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24560' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Local administrator credentials on Windows are protected by Windows LAPS' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $WindowsPolicies = $ConfigPolicies | Where-Object {
+            $_.templateReference.templateFamily -eq 'endpointSecurityAccountProtection' -and
+            $_.platforms -like '*windows10*'
+        }
+
+        if (-not $WindowsPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24560' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Windows LAPS policies found' -Risk 'High' -Name 'Local administrator credentials on Windows are protected by Windows LAPS' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $LapsPolicies = $WindowsPolicies | Where-Object {
+            $settingIds = $_.settings.settingInstance.settingDefinitionId
+            $settingIds -contains 'device_vendor_msft_laps_policies_backupdirectory' -or
+            $settingIds -contains 'device_vendor_msft_laps_policies_automaticaccountmanagementenabled'
+        }
+
+        if (-not $LapsPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24560' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No LAPS policies configured' -Risk 'High' -Name 'Local administrator credentials on Windows are protected by Windows LAPS' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $CompliantPolicies = $LapsPolicies | Where-Object {
+            $settingIds = $_.settings.settingInstance.settingDefinitionId
+            $choiceValues = $_.settings.settingInstance.choiceSettingValue.value
+
+            $hasBackupDir = $settingIds -contains 'device_vendor_msft_laps_policies_backupdirectory'
+            $hasEntraBackup = $choiceValues -contains 'device_vendor_msft_laps_policies_backupdirectory_1'
+            $hasAdBackup = $choiceValues -contains 'device_vendor_msft_laps_policies_backupdirectory_2'
+            $hasAutoMgmt = $choiceValues -contains 'device_vendor_msft_laps_policies_automaticaccountmanagementenabled_true'
+
+            ($hasBackupDir -and ($hasEntraBackup -or $hasAdBackup) -and $hasAutoMgmt)
+        }
+
+        $AssignedCompliantPolicies = $CompliantPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedCompliantPolicies) {
+            $Status = 'Passed'
+            $Result = "Cloud LAPS policy is assigned and enforced. Found $($AssignedCompliantPolicies.Count) compliant and assigned policy/policies"
+        } else {
+            $Status = 'Failed'
+            if ($CompliantPolicies) {
+                $Result = "Cloud LAPS policy exists but is not assigned. Found $($CompliantPolicies.Count) compliant but unassigned policy/policies"
+            } else {
+                $Result = 'Cloud LAPS policy is not configured correctly or not enforced'
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24560' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Local administrator credentials on Windows are protected by Windows LAPS' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24560' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Local administrator credentials on Windows are protected by Windows LAPS' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24561.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24561.md
new file mode 100644
index 000000000000..0ab82d59bffc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24561.md
@@ -0,0 +1,9 @@
+If a macOS cloud LAPS (Local Administrator Password Solution) policy is not configured and assigned in Intune, local admin accounts on enrolled macOS devices may remain unmanaged, increasing the risk of unauthorized access, privilege escalation, and lateral movement by threat actors. Without enforced LAPS policies, organizations cannot ensure that admin account credentials are rotated, unique, and securely managed, exposing sensitive systems to potential compromise.
+
+**Remediation Resources**
+
+- [Configure macOS LAPS in Microsoft Intune](https://learn.microsoft.com/en-us/intune/intune-service/enrollment/macos-laps)
+- [depOnboardingSetting resource type - Microsoft Graph beta](https://learn.microsoft.com/en-us/graph/api/resources/intune-enrollment-deponboardingsetting?view=graph-rest-beta)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24564.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24564.md
new file mode 100644
index 000000000000..e3746624d5b3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24564.md
@@ -0,0 +1,13 @@
+Without a properly configured and assigned Local Users and Groups policy in Intune, threat actors can exploit unmanaged or misconfigured local accounts on Windows devices. This can lead to unauthorized privilege escalation, persistence, and lateral movement within the environment. If local administrator accounts aren't controlled, attackers can create hidden accounts or elevate privileges, bypassing compliance and security controls. This gap increases the risk of data exfiltration, ransomware deployment, and regulatory noncompliance.
+
+Ensuring that Local Users and Groups policies are enforced on managed Windows devices, by using account protection profiles, is critical to maintaining a secure and compliant device fleet.
+
+
+**Remediation action**
+
+Configure and deploy a **Local user group membership** profile from Intune account protection policy to restrict and manage local account usage on Windows devices:  
+- Create an [Account protection policy for endpoint security in Intune](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-account-protection-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#account-protection-profiles)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24564.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24564.ps1
new file mode 100644
index 000000000000..8d969033aab5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24564.ps1
@@ -0,0 +1,57 @@
+function Invoke-CippTestZTNA24564 {
+    <#
+    .SYNOPSIS
+    Local account usage on Windows is restricted to reduce unauthorized access
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24564' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Local account usage on Windows is restricted to reduce unauthorized access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $WindowsPolicies = $ConfigPolicies | Where-Object {
+            $_.platforms -like '*windows10*'
+        }
+
+        if (-not $WindowsPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24564' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Windows policies found' -Risk 'High' -Name 'Local account usage on Windows is restricted to reduce unauthorized access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $LocalUsersGroupsPolicies = $WindowsPolicies | Where-Object {
+            $settingIds = $_.settings.settingInstance.settingDefinitionId
+            if ($settingIds -is [string]) {
+                $settingIds -eq 'device_vendor_msft_policy_config_localusersandgroups_configure'
+            } else {
+                $settingIds -contains 'device_vendor_msft_policy_config_localusersandgroups_configure'
+            }
+        }
+
+        if (-not $LocalUsersGroupsPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24564' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Local Users and Groups policy configured' -Risk 'High' -Name 'Local account usage on Windows is restricted to reduce unauthorized access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $AssignedPolicies = $LocalUsersGroupsPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedPolicies) {
+            $Status = 'Passed'
+            $Result = "At least one Local Users and Groups policy is configured and assigned. Found $($AssignedPolicies.Count) assigned policy/policies"
+        } else {
+            $Status = 'Failed'
+            $Result = "Local Users and Groups policy exists but is not assigned. Found $($LocalUsersGroupsPolicies.Count) unassigned policy/policies"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24564' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Local account usage on Windows is restricted to reduce unauthorized access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24564' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Local account usage on Windows is restricted to reduce unauthorized access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24568.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24568.md
new file mode 100644
index 000000000000..f1363b0e0739
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24568.md
@@ -0,0 +1,12 @@
+If Platform SSO policies aren't enforced on macOS devices, endpoints might rely on insecure or inconsistent authentication mechanisms, allowing attackers to bypass Conditional Access and compliance policies. This opens the door to lateral movement across cloud services and on-premises resources, especially when federated identities are used. Threat actors can persist by leveraging stolen tokens or cached credentials and exfiltrate sensitive data through unmanaged apps or browser sessions. The absence of SSO enforcement also undermines app protection policies and device posture assessments, making it difficult to detect and contain breaches. Ultimately, failure to configure and assign macOS Platform SSO policies compromises identity security and weakens the organization's Zero Trust posture.
+
+Enforcing Platform SSO policies on macOS devices ensures consistent, secure authentication across apps and services. This strengthens identity protection, supports Conditional Access enforcement, and aligns with Zero Trust by reducing reliance on local credentials and improving posture assessments.
+
+**Remediation action**
+
+Use Intune to configure and assign Platform SSO policies for macOS devices to enforce secure authentication and strengthen identity protection, see:
+
+- [Configure Platform SSO for macOS in Intune](https://learn.microsoft.com/intune/intune-service/configuration/platform-sso-macos?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) – *Step-by-step guidance for enabling Platform SSO on macOS devices.*
+- [Single sign-on (SSO) overview and options for Apple devices in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/configuration/use-enterprise-sso-plug-in-ios-ipados-macos?pivots=macos&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) – *Overview of SSO options available for Apple platforms.*<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24568.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24568.ps1
new file mode 100644
index 000000000000..7f2b58180c5b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24568.ps1
@@ -0,0 +1,59 @@
+function Invoke-CippTestZTNA24568 {
+    <#
+    .SYNOPSIS
+    Platform SSO is configured to strengthen authentication on macOS devices
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24568' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Platform SSO is configured to strengthen authentication on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Tenant'
+            return
+        }
+
+        $MacOSPolicies = $ConfigPolicies | Where-Object {
+            $_.platforms -like '*macOS*' -and
+            $_.technologies -like '*mdm*' -and
+            $_.technologies -like '*appleRemoteManagement*'
+        }
+
+        if (-not $MacOSPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24568' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No macOS policies found' -Risk 'Medium' -Name 'Platform SSO is configured to strengthen authentication on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Tenant'
+            return
+        }
+
+        $SSOPolicies = $MacOSPolicies | Where-Object {
+            $children = $_.settings.settingInstance.groupSettingCollectionValue.children
+            $extensionIdSetting = $children | Where-Object {
+                $_.settingDefinitionId -eq 'com.apple.extensiblesso_extensionidentifier'
+            }
+            $extensionValue = $extensionIdSetting.simpleSettingValue.value
+            $extensionValue -eq 'com.microsoft.CompanyPortalMac.ssoextension'
+        }
+
+        if (-not $SSOPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24568' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No macOS SSO policies configured with Microsoft Company Portal extension' -Risk 'Medium' -Name 'Platform SSO is configured to strengthen authentication on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Tenant'
+            return
+        }
+
+        $AssignedSSOPolicies = $SSOPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedSSOPolicies) {
+            $Status = 'Passed'
+            $Result = "macOS SSO policies are configured and assigned. Found $($AssignedSSOPolicies.Count) assigned policy/policies"
+        } else {
+            $Status = 'Failed'
+            $Result = "macOS SSO policy exists but is not assigned. Found $($SSOPolicies.Count) unassigned policy/policies"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24568' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Platform SSO is configured to strengthen authentication on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Tenant'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24568' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Platform SSO is configured to strengthen authentication on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24569.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24569.md
new file mode 100644
index 000000000000..b83531c58838
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24569.md
@@ -0,0 +1,12 @@
+Without properly configured and assigned FileVault encryption policies in Intune, threat actors can exploit physical access to unmanaged or misconfigured macOS devices to extract sensitive corporate data. Unencrypted devices allow attackers to bypass operating system-level security by booting from external media or removing the storage drive. These attacks can expose credentials, certificates, and cached authentication tokens, enabling privilege escalation and lateral movement. Additionally, unencrypted devices undermine compliance with data protection regulations and increase the risk of reputational damage and financial penalties in the event of a breach.
+
+Enforcing FileVault encryption protects data at rest on macOS devices, even if lost or stolen. It disrupts credential harvesting and lateral movement, supports regulatory compliance, and aligns with Zero Trust principles of device trust.
+
+**Remediation action**
+
+Use Intune to enforce FileVault encryption and monitor compliance on all managed macOS devices:  
+- [Create a FileVault disk encryption policy for macOS in Intune](https://learn.microsoft.com/intune/intune-service/protect/encrypt-devices-filevault?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-endpoint-security-policy-for-filevault)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
+- [Monitor device encryption with Intune](https://learn.microsoft.com/intune/intune-service/protect/encryption-monitor?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24569.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24569.ps1
new file mode 100644
index 000000000000..821983deda18
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24569.ps1
@@ -0,0 +1,55 @@
+function Invoke-CippTestZTNA24569 {
+    <#
+    .SYNOPSIS
+    FileVault encryption protects data on macOS devices
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24569'
+    #Tested - Device
+
+    try {
+        $DeviceConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceConfigurations'
+
+        if (-not $DeviceConfigs) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'FileVault encryption protects data on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $MacOSEndpointProtectionPolicies = @($DeviceConfigs | Where-Object {
+                $_.'@odata.type' -eq '#microsoft.graph.macOSEndpointProtectionConfiguration'
+            })
+
+        $FileVaultEnabledPolicies = @($MacOSEndpointProtectionPolicies | Where-Object { $_.fileVaultEnabled -eq $true })
+        $AssignedFileVaultPolicies = @($FileVaultEnabledPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedFileVaultPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ macOS FileVault encryption policies are configured and assigned in Intune.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No relevant macOS FileVault encryption policies are configured or assigned.`n`n"
+        }
+
+        if ($FileVaultEnabledPolicies.Count -gt 0) {
+            $ResultMarkdown += "## macOS FileVault Policies`n`n"
+            $ResultMarkdown += "| Policy Name | FileVault Enabled | Assigned |`n"
+            $ResultMarkdown += "| :---------- | :---------------- | :------- |`n"
+
+            foreach ($policy in $FileVaultEnabledPolicies) {
+                $fileVault = if ($policy.fileVaultEnabled -eq $true) { '✅ Yes' } else { '❌ No' }
+                $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+                $ResultMarkdown += "| $($policy.displayName) | $fileVault | $assigned |`n"
+            }
+        } else {
+            $ResultMarkdown += "No macOS Endpoint Protection policies with FileVault settings found.`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'FileVault encryption protects data on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'FileVault encryption protects data on macOS devices' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24570.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24570.md
new file mode 100644
index 000000000000..d25a00389cea
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24570.md
@@ -0,0 +1,9 @@
+Microsoft Entra Connect Sync using user accounts instead of service principals creates security vulnerabilities. Legacy user account authentication with passwords is more susceptible to credential theft and password attacks than service principal authentication with certificates. Compromised connector accounts allow threat actors to manipulate identity synchronization, create backdoor accounts, escalate privileges, or disrupt hybrid identity infrastructure.  
+
+**Remediation action**
+
+- [Configure service principal authentication for Entra Connect](https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id?tabs=default&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#onboard-to-application-based-authentication)
+- [Remove legacy Directory Synchronization Accounts](https://learn.microsoft.com/entra/identity/hybrid/connect/authenticate-application-id?tabs=default&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#remove-a-legacy-service-account)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24572.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24572.md
new file mode 100644
index 000000000000..a16520f6611d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24572.md
@@ -0,0 +1,16 @@
+Without device enrollment notifications, users might be unaware that their device has been enrolled in Intune—particularly in cases of unauthorized or unexpected enrollment. This lack of visibility can delay user reporting of suspicious activity and increase the risk of unmanaged or compromised devices gaining access to corporate resources. Attackers who obtain user credentials or exploit self-enrollment flows can silently onboard devices, bypassing user scrutiny and enabling data exposure or lateral movement.
+
+Enrollment notifications provide users with improved visibility into device onboarding activity. They help detect unauthorized enrollment, reinforce secure provisioning practices, and support Zero Trust principles of visibility, verification, and user engagement.
+
+**Remediation action**
+
+Configure Intune enrollment notifications to alert users when their device is enrolled and reinforce secure onboarding practices:  
+- [Set up enrollment notifications in Intune](https://learn.microsoft.com/intune/intune-service/enrollment/enrollment-notifications?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+
+
+
+
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24573.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24573.md
new file mode 100644
index 000000000000..d769655b0fae
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24573.md
@@ -0,0 +1,11 @@
+Without properly configured and assigned Intune security baselines for Windows, devices remain vulnerable to a wide array of attack vectors that threat actors exploit to gain persistence and escalate privileges. Adversaries leverage default Windows configurations that lack hardened security settings to perform lateral movement using techniques like credential dumping, privilege escalation via unpatched vulnerabilities, and exploitation of weak authentication mechanisms. In the absence of enforced security baselines, threat actors can bypass critical security controls, maintain persistence through registry modifications, and exfiltrate sensitive data through unmonitored channels. Failing to implement a defense-in-depth strategy makes devices easier to exploit as attackers progress through the attack chain—from initial access to data exfiltration—ultimately compromising the organization’s security posture and increasing the risk of compliance violations.
+
+Applying security baselines ensures Windows devices are configured with hardened settings, reducing attack surface, enforcing defense-in-depth, and supporting Zero Trust by standardizing security controls across the environment.
+
+**Remediation action**
+
+Configure and assign Intune security baselines to Windows devices to enforce standardized security settings and monitor compliance:
+- [Deploy security baselines to help secure Windows devices](https://learn.microsoft.com/intune/intune-service/protect/security-baselines-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-a-profile-for-a-security-baseline)
+- [Monitor security baseline compliance](https://learn.microsoft.com/intune/intune-service/protect/security-baselines-monitor?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24574.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24574.md
new file mode 100644
index 000000000000..4f43396f391a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24574.md
@@ -0,0 +1,14 @@
+If Intune profiles for Attack Surface Reduction (ASR) rules aren't properly configured and assigned to Windows devices, threat actors can exploit unprotected endpoints to execute obfuscated scripts and invoke Win32 API calls from Office macros. These techniques are commonly used in phishing campaigns and malware delivery, allowing attackers to bypass traditional antivirus defenses and gain initial access. Once inside, attackers escalate privileges, establish persistence, and move laterally across the network. Without ASR enforcement, devices remain vulnerable to script-based attacks and macro abuse, undermining the effectiveness of Microsoft Defender and exposing sensitive data to exfiltration. This gap in endpoint protection increases the likelihood of successful compromise and reduces the organization’s ability to contain and respond to threats.
+
+Enforcing ASR rules helps block common attack techniques such as script-based execution and macro abuse, reducing the risk of initial compromise and supporting Zero Trust by hardening endpoint defenses.
+
+**Remediation action**
+
+Use Intune to deploy **Attack Surface Reduction Rules** profiles for Windows devices to block high-risk behaviors and strengthen endpoint protection:
+- [Configure Intune profiles for Attack Surface Reduction Rules](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-asr-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#devices-managed-by-intune)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
+
+For more information, see:  
+- [Attack surface reduction rules reference](https://learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-reference?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) in the Microsoft Defender documentation.<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24574.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24574.ps1
new file mode 100644
index 000000000000..50a4ff1efbf2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24574.ps1
@@ -0,0 +1,73 @@
+function Invoke-CippTestZTNA24574 {
+    <#
+    .SYNOPSIS
+    Attack Surface Reduction rules are applied to Windows devices to prevent exploitation of vulnerable system components
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24574' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Attack Surface Reduction rules are applied to Windows devices to prevent exploitation of vulnerable system components' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Device'
+            return
+        }
+
+        $Win10MdmSensePolicies = $ConfigPolicies | Where-Object {
+            $_.platforms -like '*windows10*' -and
+            $_.technologies -like '*mdm*' -and
+            $_.technologies -like '*microsoftSense*'
+        }
+
+        if (-not $Win10MdmSensePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24574' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Windows ASR policies found' -Risk 'High' -Name 'Attack Surface Reduction rules are applied to Windows devices to prevent exploitation of vulnerable system components' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Device'
+            return
+        }
+
+        $ASRPolicies = $Win10MdmSensePolicies | Where-Object {
+            $settingIds = $_.settings.settingInstance.settingDefinitionId
+            $settingIds -contains 'device_vendor_msft_policy_config_defender_attacksurfacereductionrules'
+        }
+
+        if (-not $ASRPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24574' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Attack Surface Reduction policies found' -Risk 'High' -Name 'Attack Surface Reduction rules are applied to Windows devices to prevent exploitation of vulnerable system components' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Device'
+            return
+        }
+
+        $ObfuscatedScriptPolicies = $ASRPolicies | Where-Object {
+            $children = $_.settings.settingInstance.groupSettingCollectionValue.children
+            $settingId = 'device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockexecutionofpotentiallyobfuscatedscripts'
+            $matchingSetting = $children | Where-Object { $_.settingDefinitionId -eq $settingId }
+            $value = $matchingSetting.choiceSettingValue.value
+            $value -like '*_block' -or $value -like '*_warn'
+        }
+
+        $Win32MacroPolicies = $ASRPolicies | Where-Object {
+            $children = $_.settings.settingInstance.groupSettingCollectionValue.children
+            $settingId = 'device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockwin32apicallsfromofficemacros'
+            $matchingSetting = $children | Where-Object { $_.settingDefinitionId -eq $settingId }
+            $value = $matchingSetting.choiceSettingValue.value
+            $value -like '*_block' -or $value -like '*_warn'
+        }
+
+        $AssignedObfuscated = $ObfuscatedScriptPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 }
+        $AssignedWin32Macro = $Win32MacroPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 }
+
+        if ($AssignedObfuscated -and $AssignedWin32Macro) {
+            $Status = 'Passed'
+            $Result = 'ASR policies are configured and assigned with required rules (obfuscated scripts and Win32 API calls from macros)'
+        } elseif ($AssignedObfuscated -or $AssignedWin32Macro) {
+            $Status = 'Failed'
+            $Result = "ASR policies partially configured. Missing: $(if (-not $AssignedObfuscated) { 'obfuscated scripts rule ' })$(if (-not $AssignedWin32Macro) { 'Win32 API calls rule' })"
+        } else {
+            $Status = 'Failed'
+            $Result = 'ASR policies found but not properly configured or assigned for required rules'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24574' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Attack Surface Reduction rules are applied to Windows devices to prevent exploitation of vulnerable system components' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24574' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Attack Surface Reduction rules are applied to Windows devices to prevent exploitation of vulnerable system components' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24575.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24575.md
new file mode 100644
index 000000000000..05f917a22a85
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24575.md
@@ -0,0 +1,13 @@
+If policies for Microsoft Defender Antivirus aren't properly configured and assigned in Intune, threat actors can exploit unprotected endpoints to execute malware, disable antivirus protections, and persist within the environment. Without enforced antivirus policies, devices operate with outdated definitions, disabled real-time protection, or misconfigured scan schedules. These gaps allow attackers to bypass detection, escalate privileges, and move laterally across the network. The absence of antivirus enforcement undermines device compliance, increases exposure to zero-day threats, and can result in regulatory noncompliance. Attackers leverage these weaknesses to maintain persistence and evade detection, especially in environments lacking centralized policy enforcement.
+
+Enforcing Defender Antivirus policies ensures consistent protection against malware, supports real-time threat detection, and aligns with Zero Trust by maintaining a secure and compliant endpoint posture.
+
+**Remediation action**
+
+Configure and assign Intune policies for Microsoft Defender Antivirus to enforce real-time protection, maintain up-to-date definitions, and reduce exposure to malware:
+
+- [Configure Intune policies to manage Microsoft Defender Antivirus](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-antivirus-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#windows)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24575.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24575.ps1
new file mode 100644
index 000000000000..a86aafd31fb9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24575.ps1
@@ -0,0 +1,54 @@
+function Invoke-CippTestZTNA24575 {
+    <#
+    .SYNOPSIS
+    Defender Antivirus policies protect Windows devices from malware
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24575' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Defender Antivirus policies protect Windows devices from malware' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
+            return
+        }
+
+        $MdmSensePolicies = $ConfigPolicies | Where-Object {
+            $_.platforms -like '*windows10*' -and
+            $_.technologies -like '*mdm*' -and
+            $_.technologies -like '*microsoftSense*'
+        }
+
+        if (-not $MdmSensePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24575' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Windows Defender policies found' -Risk 'High' -Name 'Defender Antivirus policies protect Windows devices from malware' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
+            return
+        }
+
+        $AVPolicies = $MdmSensePolicies | Where-Object {
+            $_.templateReference.templateFamily -eq 'endpointSecurityAntivirus'
+        }
+
+        if (-not $AVPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24575' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Windows Defender Antivirus policies found' -Risk 'High' -Name 'Defender Antivirus policies protect Windows devices from malware' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
+            return
+        }
+
+        $AssignedPolicies = $AVPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedPolicies) {
+            $Status = 'Passed'
+            $Result = "Windows Defender Antivirus policies are configured and assigned. Found $($AssignedPolicies.Count) assigned policy/policies"
+        } else {
+            $Status = 'Failed'
+            $Result = "Windows Defender Antivirus policies exist but are not assigned. Found $($AVPolicies.Count) unassigned policy/policies"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24575' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Defender Antivirus policies protect Windows devices from malware' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24575' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Defender Antivirus policies protect Windows devices from malware' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24576.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24576.md
new file mode 100644
index 000000000000..a9852ccab073
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24576.md
@@ -0,0 +1,14 @@
+If endpoint analytics isn't enabled, threat actors can exploit gaps in device health, performance, and security posture. Without the visibility Endpoint analytics brings, it can be difficult for an organization to detect indicators such as anomalous device behavior, delayed patching, or configuration drift. These gaps allow attackers to establish persistence, escalate privileges, and move laterally across the environment. An absence of analytics data can impede rapid detection and response, allowing attackers to exploit unmonitored endpoints for command and control, data exfiltration, or further compromise.
+
+Enabling Endpoint Analytics provides visibility into device health and behavior, helping organizations detect risks, respond quickly to threats, and maintain a strong Zero Trust posture.
+
+**Remediation action**
+
+Enroll Windows devices into Endpoint Analytics in Intune to monitor device health and identify risks:  
+- [Enroll Intune devices into Endpoint analytics](https://learn.microsoft.com/intune/analytics/enroll-intune?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+For more information, see:
+- [What is Endpoint analytics?](https://learn.microsoft.com/intune/analytics?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24576.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24576.ps1
new file mode 100644
index 000000000000..eac9abcb2266
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24576.ps1
@@ -0,0 +1,53 @@
+function Invoke-CippTestZTNA24576 {
+    <#
+    .SYNOPSIS
+    Endpoint Analytics is enabled to help identify risks on Windows devices
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24576'
+    #Tested - Device
+
+    try {
+        $DeviceConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceConfigurations'
+
+        if (-not $DeviceConfigs) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Endpoint Analytics is enabled to help identify risks on Windows devices' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $WindowsHealthMonitoringPolicies = @($DeviceConfigs | Where-Object {
+                $_.'@odata.type' -eq '#microsoft.graph.windowsHealthMonitoringConfiguration'
+            })
+
+        $AssignedPolicies = @($WindowsHealthMonitoringPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedPolicies.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ An Endpoint analytics policy is created and assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ Endpoint analytics policy is not created or not assigned.`n`n"
+        }
+
+        if ($WindowsHealthMonitoringPolicies.Count -gt 0) {
+            $ResultMarkdown += "## Endpoint Analytics Policies`n`n"
+            $ResultMarkdown += "| Policy Name | Assigned |`n"
+            $ResultMarkdown += "| :---------- | :------- |`n"
+
+            foreach ($policy in $WindowsHealthMonitoringPolicies) {
+                $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+                $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+            }
+        } else {
+            $ResultMarkdown += "No Endpoint Analytics policies found in this tenant.`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'Low' -Name 'Endpoint Analytics is enabled to help identify risks on Windows devices' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Endpoint Analytics is enabled to help identify risks on Windows devices' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24690.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24690.md
new file mode 100644
index 000000000000..1503d4f1d531
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24690.md
@@ -0,0 +1,11 @@
+If macOS update policies aren’t properly configured and assigned, threat actors can exploit unpatched vulnerabilities in macOS devices within the organization. Without enforced update policies, devices remain on outdated software versions, increasing the attack surface for privilege escalation, remote code execution, or persistence techniques. Threat actors can leverage these weaknesses to gain initial access, escalate privileges, and move laterally within the environment. If policies exist but aren’t assigned to device groups, endpoints remain unprotected, and compliance gaps go undetected. This can result in widespread compromise, data exfiltration, and operational disruption.
+
+Enforcing macOS update policies ensures devices receive timely patches, reducing the risk of exploitation and supporting Zero Trust by maintaining a secure, compliant device fleet.
+
+**Remediation action**
+
+Configure and assign macOS update policies in Intune to enforce timely patching and reduce risk from unpatched vulnerabilities:  
+- [Manage macOS software updates in Intune](https://learn.microsoft.com/intune/intune-service/protect/software-updates-macos?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24784.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24784.md
new file mode 100644
index 000000000000..8bb2009ede0f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24784.md
@@ -0,0 +1,11 @@
+If Microsoft Defender Antivirus policies aren't properly configured and assigned to macOS devices in Intune, attackers can exploit unprotected endpoints to execute malware, disable antivirus protections, and persist in the environment. Without enforced policies, devices run outdated definitions, lack real-time protection, or have misconfigured scan schedules, increasing the risk of undetected threats and privilege escalation. This enables lateral movement across the network, credential harvesting, and data exfiltration. The absence of antivirus enforcement undermines device compliance, increases exposure of endpoints to zero-day threats, and can result in regulatory noncompliance. Attackers use these gaps to maintain persistence and evade detection, especially in environments without centralized policy enforcement.
+
+Enforcing Defender Antivirus policies ensures that macOS devices are consistently protected against malware, supports real-time threat detection, and aligns with Zero Trust by maintaining a secure and compliant endpoint posture.
+
+**Remediation action**
+
+Use Intune to configure and assign Microsoft Defender Antivirus policies for macOS devices to enforce real-time protection, maintain up-to-date definitions, and reduce exposure to malware:  
+- [Configure Intune policies to manage Microsoft Defender Antivirus](https://learn.microsoft.com/intune/intune-service/protect/endpoint-security-antivirus-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#macos)
+- [Assign policies in Intune](https://learn.microsoft.com/intune/intune-service/configuration/device-profile-assign?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assign-a-policy-to-users-or-groups)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24784.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24784.ps1
new file mode 100644
index 000000000000..75a6b173b5ae
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24784.ps1
@@ -0,0 +1,54 @@
+function Invoke-CippTestZTNA24784 {
+    <#
+    .SYNOPSIS
+    Defender Antivirus policies protect macOS devices from malware
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    try {
+        $ConfigPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
+        if (-not $ConfigPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24784' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Defender Antivirus policies protect macOS devices from malware' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $MdmMacOSSensePolicies = $ConfigPolicies | Where-Object {
+            $_.platforms -like '*macOS*' -and
+            $_.technologies -like '*mdm*' -and
+            $_.technologies -like '*microsoftSense*'
+        }
+
+        if (-not $MdmMacOSSensePolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24784' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No macOS Defender policies found' -Risk 'High' -Name 'Defender Antivirus policies protect macOS devices from malware' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $AVPolicies = $MdmMacOSSensePolicies | Where-Object {
+            $_.templateReference.templateFamily -eq 'endpointSecurityAntivirus'
+        }
+
+        if (-not $AVPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24784' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Defender Antivirus policies for macOS found' -Risk 'High' -Name 'Defender Antivirus policies protect macOS devices from malware' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+            return
+        }
+
+        $AssignedPolicies = $AVPolicies | Where-Object {
+            $_.assignments -and $_.assignments.Count -gt 0
+        }
+
+        if ($AssignedPolicies) {
+            $Status = 'Passed'
+            $Result = "Defender Antivirus policies for macOS are configured and assigned. Found $($AssignedPolicies.Count) assigned policy/policies"
+        } else {
+            $Status = 'Failed'
+            $Result = "Defender Antivirus policies for macOS exist but are not assigned. Found $($AVPolicies.Count) unassigned policy/policies"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24784' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Defender Antivirus policies protect macOS devices from malware' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA24784' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Defender Antivirus policies protect macOS devices from malware' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24794.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24794.md
new file mode 100644
index 000000000000..36309a2e234e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24794.md
@@ -0,0 +1,10 @@
+If Terms and Conditions policies aren't configured and assigned in Intune, users can access corporate resources without agreeing to required legal, security, or usage terms. This omission exposes the organization to compliance risks, legal liabilities, and potential misuse of resources.
+
+Enforcing Terms and Conditions ensures users acknowledge and accept company policies before accessing sensitive data or systems, supporting regulatory compliance and responsible resource use.
+
+**Remediation action**
+
+Create and assign Terms and Conditions policies in Intune to require user acceptance before granting access to corporate resources:  
+- [Create terms and conditions policy](https://learn.microsoft.com/intune/intune-service/enrollment/terms-and-conditions-create?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24802.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24802.md
new file mode 100644
index 000000000000..33d8505d0aa4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24802.md
@@ -0,0 +1,15 @@
+If device cleanup rules aren't configured in Intune, stale or inactive devices can remain visible in the tenant indefinitely. This leads to cluttered device lists, inaccurate reporting, and reduced visibility into the active device landscape. Unused devices might retain access credentials or tokens, increasing the risk of unauthorized access or misinformed policy decisions. 
+
+Device cleanup rules automatically hide inactive devices from admin views and reports, improving tenant hygiene and reducing administrative burden. This supports Zero Trust by maintaining an accurate and trustworthy device inventory while preserving historical data for audit or investigation.
+
+**Remediation action**
+
+Configure Intune device cleanup rules to automatically hide inactive devices from the tenant:  
+- [Create a device cleanup rule](https://learn.microsoft.com/intune/intune-service/fundamentals/device-cleanup-rules?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#how-to-create-a-device-cleanup-rule)
+
+For more information, see:  
+- [Using Intune device cleanup rules](https://techcommunity.microsoft.com/blog/devicemanagementmicrosoft/using-intune-device-cleanup-rules-updated-version/3760854) *on the Microsoft Tech Community blog*
+
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24823.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24823.md
new file mode 100644
index 000000000000..846bef7a09b7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24823.md
@@ -0,0 +1,12 @@
+If the Intune Company Portal branding isn't configured to represent your organization’s details, users can encounter a generic interface and lack direct support information. This reduces user trust, increases support overhead, and can lead to confusion or delays in resolving issues.
+
+Customizing the Company Portal with your organization’s branding and support contact details improves user trust, streamlines support, and reinforces the legitimacy of device management communications.
+
+
+**Remediation action**
+
+Configure the Intune Company Portal with your organization’s branding and support contact information to enhance user experience and reduce support overhead:  
+- [Configure the Intune Company Portal](https://learn.microsoft.com/intune/intune-service/apps/company-portal-app?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24824.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24824.md
new file mode 100644
index 000000000000..355aaf0621c4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24824.md
@@ -0,0 +1,15 @@
+If Microsoft Entra Conditional Access policies don't enforce device compliance, users can connect to corporate resources from devices that don't meet security standards. This exposes sensitive data to risks like malware, unauthorized access, and regulatory noncompliance. Without controls like encryption enforcement, device health checks, and access restrictions, threat actors can exploit noncompliant devices to bypass security measures and maintain persistence.
+
+
+Requiring device compliance in Conditional Access policies ensures only trusted and secure devices can access corporate resources. This supports Zero Trust by enforcing access decisions based on device health and compliance posture.
+
+**Remediation action**
+
+Configure Conditional Access policies in Microsoft Entra to require device compliance before granting access to corporate resources:  
+- [Create a device compliance-based Conditional Access policy](https://learn.microsoft.com/intune/intune-service/protect/create-conditional-access-intune?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+For more information, see:
+- [What is Conditional Access?](https://learn.microsoft.com/entra/identity/conditional-access/overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Integrate device compliance results with Conditional Access](https://learn.microsoft.com/intune/intune-service/protect/device-compliance-get-started?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#integrate-with-conditional-access)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24827.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24827.md
new file mode 100644
index 000000000000..a13c08cc8982
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24827.md
@@ -0,0 +1,15 @@
+If Microsoft Entra Conditional Access policies aren't combined with app protection controls, users can connect to corporate resources through unmanaged or unsecured applications. This exposes sensitive data to risks such as data leakage, unauthorized access, and regulatory noncompliance. Without safeguards like app-level data protection, access restrictions, and data loss prevention, threat actors can exploit unprotected apps to bypass security controls and compromise organizational data.
+
+Enforcing Intune app protection policies within Conditional Access ensures only trusted apps can access corporate data. This supports Zero Trust by enforcing access decisions based on app trust, data containment, and usage restrictions.
+
+**Remediation action**
+
+Configure app-based Conditional Access policies in Microsoft Entra and Intune to require app protection for access to corporate resources:  
+- [Set up app-based Conditional Access policies with Intune](https://learn.microsoft.com/intune/intune-service/protect/app-based-conditional-access-intune-create?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+For more information, see:  
+- [What is Conditional Access?](https://learn.microsoft.com/entra/identity/conditional-access/overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Learn about app-based Conditional Access policies with Intune](https://learn.microsoft.com/intune/intune-service/protect/app-based-conditional-access-intune?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24839.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24839.md
new file mode 100644
index 000000000000..be254bba4f88
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24839.md
@@ -0,0 +1,15 @@
+If Wi-Fi profiles aren't properly configured and assigned, users can connect insecurely or fail to connect to trusted networks, exposing corporate data to interception or unauthorized access. Without centralized management, devices rely on manual configuration, increasing the risk of misconfiguration, weak authentication, and connection to rogue networks.
+
+Centrally managing Wi-Fi profiles for iOS devices in Intune ensures secure and consistent connectivity to enterprise networks. This enforces authentication and encryption standards, simplifies onboarding, and supports Zero Trust by reducing exposure to untrusted networks.
+
+**Remediation action**
+
+Use Intune to configure and assign secure Wi-Fi profiles for iOS/iPadOS devices to enforce authentication and encryption standards:
+
+- [Deploy Wi-Fi profiles to devices in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/configuration/wi-fi-settings-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-profile)
+
+For more information, see:  
+- [Review the available Wi-Fi settings for iOS and iPadOS devices in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/configuration/wi-fi-settings-ios?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24839.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24839.ps1
new file mode 100644
index 000000000000..0ea86eb3dcef
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24839.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestZTNA24839 {
+    <#
+    .SYNOPSIS
+    Secure Wi-Fi profiles protect iOS devices from unauthorized network access
+    #>
+    param($Tenant)
+    #Tested - Device
+
+    $TestId = 'ZTNA24839'
+
+    try {
+        $DeviceConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceConfigurations'
+
+        if (-not $DeviceConfigs) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Secure Wi-Fi profiles protect iOS devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Data'
+            return
+        }
+
+        $iOSWifiConfProfiles = @($DeviceConfigs | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.iosWiFiConfiguration' })
+        $CompliantIosWifiConfProfiles = @($iOSWifiConfProfiles | Where-Object { $_.wiFiSecurityType -in @('wpa2Enterprise', 'wpaEnterprise') })
+        $AssignedCompliantProfiles = @($CompliantIosWifiConfProfiles | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedCompliantProfiles.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one Enterprise Wi-Fi profile for iOS exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No Enterprise Wi-Fi profile for iOS exists or none are assigned.`n`n"
+        }
+
+        if ($iOSWifiConfProfiles.Count -gt 0) {
+            $ResultMarkdown += "## iOS WiFi Configuration Profiles`n`n"
+            $ResultMarkdown += "| Policy Name | Wi-Fi Security Type | Assigned |`n"
+            $ResultMarkdown += "| :---------- | :------------------ | :------- |`n"
+
+            foreach ($policy in $iOSWifiConfProfiles) {
+                $securityType = if ($policy.wiFiSecurityType) { $policy.wiFiSecurityType } else { 'Unknown' }
+                $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+                $ResultMarkdown += "| $($policy.displayName) | $securityType | $assigned |`n"
+            }
+        } else {
+            $ResultMarkdown += "No iOS WiFi configuration profiles found.`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Secure Wi-Fi profiles protect iOS devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Data'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Secure Wi-Fi profiles protect iOS devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Data'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24840.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24840.md
new file mode 100644
index 000000000000..fbfac84b107a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24840.md
@@ -0,0 +1,18 @@
+If Wi-Fi profiles aren't properly configured and assigned, Android devices can fail to connect to secure networks or connect insecurely, exposing corporate data to interception or unauthorized access. Without centralized management, devices rely on manual configuration, increasing the risk of misconfiguration, weak authentication, and connection to rogue networks.
+
+Centrally managing Wi-Fi profiles for Android devices in Intune ensures secure and consistent connectivity to enterprise networks. This enforces authentication and encryption standards, simplifies onboarding, and supports Zero Trust by reducing exposure to untrusted networks.
+
+
+
+Use Intune to configure secure Wi-Fi profiles that enforce authentication and encryption standards.
+
+**Remediation action**
+
+Use Intune to configure and assign secure Wi-Fi profiles for Android devices to enforce authentication and encryption standards:  
+- [Deploy Wi-Fi profiles to devices in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/configuration/wi-fi-settings-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-profile)
+
+For more information, see:  
+- [Review the available Wi-Fi settings for Android devices in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/configuration/wi-fi-settings-android-enterprise?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24840.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24840.ps1
new file mode 100644
index 000000000000..1468e4345741
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24840.ps1
@@ -0,0 +1,53 @@
+function Invoke-CippTestZTNA24840 {
+    <#
+    .SYNOPSIS
+    Secure Wi-Fi profiles protect Android devices from unauthorized network access
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24840'
+
+    #Tested - Device
+
+    try {
+        $DeviceConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceConfigurations'
+
+        if (-not $DeviceConfigs) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Secure Wi-Fi profiles protect Android devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data'
+            return
+        }
+
+        $AndroidWifiConfProfiles = @($DeviceConfigs | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.androidDeviceOwnerEnterpriseWiFiConfiguration' })
+        $CompliantAndroidWifiConfProfiles = @($AndroidWifiConfProfiles | Where-Object { $_.wiFiSecurityType -eq 'wpaEnterprise' })
+        $AssignedCompliantProfiles = @($CompliantAndroidWifiConfProfiles | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedCompliantProfiles.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one Enterprise Wi-Fi profile for android exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No Enterprise Wi-Fi profile for android exists or none are assigned.`n`n"
+        }
+
+        if ($CompliantAndroidWifiConfProfiles.Count -gt 0) {
+            $ResultMarkdown += "## Android Wi-Fi Configuration Profiles`n`n"
+            $ResultMarkdown += "| Policy Name | Wi-Fi Security Type | Assigned |`n"
+            $ResultMarkdown += "| :---------- | :------------------ | :------- |`n"
+
+            foreach ($policy in $CompliantAndroidWifiConfProfiles) {
+                $securityType = if ($policy.wiFiSecurityType) { $policy.wiFiSecurityType } else { 'Unknown' }
+                $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+                $ResultMarkdown += "| $($policy.displayName) | $securityType | $assigned |`n"
+            }
+        } else {
+            $ResultMarkdown += "No compliant Android Enterprise WiFi configuration profiles found.`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Secure Wi-Fi profiles protect Android devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Secure Wi-Fi profiles protect Android devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24870.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24870.md
new file mode 100644
index 000000000000..d0b2121a7e67
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24870.md
@@ -0,0 +1,15 @@
+If Wi-Fi profiles aren't properly configured and assigned, macOS devices can fail to connect to secure networks or connect insecurely, exposing corporate data to interception or unauthorized access. Without centralized management, devices rely on manual configuration, increasing the risk of misconfiguration, weak authentication, and connection to rogue networks. These gaps can lead to data interception, unauthorized network access, and compliance violations.
+
+Centrally managing Wi-Fi profiles for macOS devices in Intune ensures secure and consistent connectivity to enterprise networks. This enforces authentication and encryption standards, simplifies onboarding, and supports Zero Trust by reducing exposure to untrusted networks.
+
+**Remediation action**
+
+Use Intune to configure and assign secure Wi-Fi profiles for macOS devices to enforce authentication and encryption standards:
+
+- [Configure Wi-Fi settings for macOS devices in Intune](https://learn.microsoft.com/intune/intune-service/configuration/wi-fi-settings-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-the-profile)
+
+For more information, see:
+
+- [Review the available Wi-Fi settings for macOS devices in Microsoft Intune](https://learn.microsoft.com/intune/intune-service/configuration/wi-fi-settings-macos?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24870.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24870.ps1
new file mode 100644
index 000000000000..5e2183226768
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24870.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestZTNA24870 {
+    <#
+    .SYNOPSIS
+    Secure Wi-Fi profiles protect macOS devices from unauthorized network access
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24870'
+    #Tested - Device
+
+    try {
+        $DeviceConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceConfigurations'
+
+        if (-not $DeviceConfigs) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Secure Wi-Fi profiles protect macOS devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data'
+            return
+        }
+
+        $MacOSWifiConfProfiles = @($DeviceConfigs | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.macOSWiFiConfiguration' })
+        $CompliantMacOSWifiConfProfiles = @($MacOSWifiConfProfiles | Where-Object { $_.wiFiSecurityType -eq 'wpaEnterprise' })
+        $AssignedCompliantProfiles = @($CompliantMacOSWifiConfProfiles | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedCompliantProfiles.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one Enterprise Wi-Fi profile for macOS exists and is assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No Enterprise Wi-Fi profile for macOS exists or none are assigned.`n`n"
+        }
+
+        if ($CompliantMacOSWifiConfProfiles.Count -gt 0) {
+            $ResultMarkdown += "## macOS WiFi Configuration Profiles`n`n"
+            $ResultMarkdown += "| Policy Name | Wi-Fi Security Type | Assigned |`n"
+            $ResultMarkdown += "| :---------- | :------------------ | :------- |`n"
+
+            foreach ($policy in $CompliantMacOSWifiConfProfiles) {
+                $securityType = if ($policy.wiFiSecurityType) { $policy.wiFiSecurityType } else { 'Unknown' }
+                $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+                $ResultMarkdown += "| $($policy.displayName) | $securityType | $assigned |`n"
+            }
+        } else {
+            $ResultMarkdown += "No compliant macOS Enterprise WiFi configuration profiles found.`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Secure Wi-Fi profiles protect macOS devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Secure Wi-Fi profiles protect macOS devices from unauthorized network access' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Data'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24871.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24871.md
new file mode 100644
index 000000000000..a326a1b7c66d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA24871.md
@@ -0,0 +1,12 @@
+If automatic enrollment into Microsoft Defender for Endpoint isn't configured for Android devices in Intune, managed endpoints might remain unprotected against mobile threats. Without Defender onboarding, devices lack advanced threat detection and response capabilities, increasing the risk of malware, phishing, and other mobile-based attacks. Unprotected devices can bypass security policies, access corporate resources, and expose sensitive data to compromise. This gap in mobile threat defense weakens the organization's Zero Trust posture and reduces visibility into endpoint health.
+
+Enabling automatic Defender enrollment ensures Android devices are protected by advanced threat detection and response capabilities. This supports Zero Trust by enforcing mobile threat protection, improving visibility, and reducing exposure to unmanaged or compromised endpoints.
+
+**Remediation action**
+
+Use Intune to configure automatic enrollment into Microsoft Defender for Endpoint for Android devices to enforce mobile threat protection:
+
+- [Integrate Microsoft Defender for Endpoint with Intune and Onboard Devices](https://learn.microsoft.com/intune/intune-service/protect/advanced-threat-protection-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25370.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25370.md
new file mode 100644
index 000000000000..7292aeb5fa36
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25370.md
@@ -0,0 +1,8 @@
+When organizations deploy Global Secure Access as their cloud-based network proxy, user traffic is routed through Microsoft's Secure Service Edge infrastructure. Without source IP restoration enabled, all authentication requests and resource access appear to originate from the proxy's IP address rather than the user's actual public egress IP. This creates a significant security gap: threat actors who compromise user credentials can authenticate from any location, and the organization's Conditional Access policies that rely on IP-based location controls become ineffective since all traffic appears to come from the same proxy addresses. Microsoft Entra ID Protection risk detections lose visibility into the original user IP address, degrading the accuracy of risk scoring algorithms that depend on geographic and network anomaly detection. Sign-in logs and audit trails no longer reflect the true source of authentication attempts, hampering incident investigation and forensic analysis. A threat actor exploiting this gap could perform credential stuffing or phishing attacks and subsequently authenticate to tenant resources while bypassing named location policies, trusted IP controls, and IP-based continuous access evaluation enforcement. The attacker's activity would blend with legitimate proxy traffic, delaying detection and extending dwell time. Enabling Global Secure Access signalling in Conditional Access restores the original user source IP to Microsoft Entra ID, Microsoft Graph, sign-in logs, and audit logs, preserving the integrity of IP-based security controls and risk assessments.
+
+**Remediation action**
+- [Enable Global Secure Access signaling in Conditional Access](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-source-ip-restoration)
+
+- [Use Microsoft Graph API to enable signaling](https://learn.microsoft.com/en-us/graph/api/networkaccess-conditionalaccesssettings-update )
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25381.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25381.md
new file mode 100644
index 000000000000..4926d8187932
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25381.md
@@ -0,0 +1,20 @@
+Traffic forwarding profiles are the foundational mechanism through which Global Secure Access captures and routes network traffic to Microsoft's Security Service Edge (SSE) infrastructure. Without enabling the appropriate traffic forwarding profiles, network traffic bypasses the Global Secure Access service entirely, leaving users without zero trust network access protections.
+
+There are three distinct profiles: the **Microsoft traffic profile** captures Microsoft Entra ID, Microsoft Graph, SharePoint Online, Exchange Online, and other Microsoft 365 workloads; the **Private Access profile** captures traffic destined for internal corporate resources configured through Quick Access or per-app access; and the **Internet Access profile** captures traffic to the public internet including non-Microsoft SaaS applications.
+
+When these profiles are disabled, corresponding network traffic is not tunneled through Global Secure Access, meaning security policies, web content filtering, threat protection, and Universal Continuous Access Evaluation cannot be enforced. A threat actor who compromises user credentials can access corporate resources without the security controls that Global Secure Access would otherwise apply.
+
+For **Private Access**, disabled profiles mean remote users cannot securely connect to internal applications, file servers, or Remote Desktop sessions through the zero-trust model—potentially forcing fallback to legacy VPN solutions with broader network access.
+
+For **Internet Access**, disabled profiles mean users accessing external SaaS applications, collaboration tools, or web resources are not protected by security policies, and data exfiltration to unauthorized internet destinations cannot be prevented.
+
+**Remediation action**
+
+Enable all traffic forwarding profiles to ensure comprehensive protection:
+
+- [Enable the Microsoft 365 traffic forwarding profile](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-microsoft-profile)
+- [Enable the Private Access traffic forwarding profile](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-private-access-profile)
+- [Enable the Internet Access traffic forwarding profile](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-internet-access-profile)
+- [Understand traffic forwarding profile concepts](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-traffic-forwarding)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25391.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25391.md
new file mode 100644
index 000000000000..91d0f532b3ed
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25391.md
@@ -0,0 +1,12 @@
+When Entra Private Network Connectors are inactive or unhealthy, threat actors operating under assume breach conditions can exploit the lack of secure remote access control. Connectors create outbound connections to the Private Access services to reach internal resources, and when these connectors fail, organizations may resort to alternatives such as exposing applications directly or using less secure access methods. This creates initial access opportunities where threat actors can target externally exposed services or leverage compromised VPN credentials. Following successful authentication through weakened access controls, threat actors can establish persistence by maintaining access to internal resources that would otherwise require connector-based authentication and authorization checks.  
+
+The absence of functional connectors eliminates the token-based authentication and authorization performed for all Private Access scenarios, enabling lateral movement as threat actors traverse the network without the granular access controls enforced by connector groups. The service routes new requests to an available connector, and if a connector is temporarily unavailable, it does not receive traffic meaning connector failures directly disrupt zero trust network access controls. Organizations may then implement workarounds that bypass intended security boundaries, facilitating privilege escalation as threat actors exploit the degraded security posture to access resources beyond their authorization scope. 
+
+**Remediation action**
+
+- [Troubleshoot connector installation and connectivity issues](https://learn.microsoft.com/en-us/entra/global-secure-access/troubleshoot-connectors)
+- [Configure connectors for high availability](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors)
+- [Monitor connector health and performance](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-connectors)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25392.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25392.md
new file mode 100644
index 000000000000..2093de19c302
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25392.md
@@ -0,0 +1,10 @@
+The Private Network Connector is a key component of Entra Private Access and Entra Application Proxy. To maintain security, stability, and performance, it's essential that all connector machines run the latest software version. This check reviews every private network connector in your environment, compares the installed version with the most recent release, and flags any connectors that are not up to date. If any connector is outdated, the check will fail and provide a detailed list of current versions.
+
+**Remediation action**
+
+Please check this article which shows the release notes and latest version of the private network connector. 
+- [Microsoft Entra private network connector version release notes - Global Secure Access](https://learn.microsoft.com/entra/global-secure-access/reference-version-history)
+
+**Note**: Please be aware that not every connector update is an auto-update and some need to be applied manually. Auto-update will only work if the connector updater process on your machine is running.
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25399.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25399.md
new file mode 100644
index 000000000000..e62759175a00
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25399.md
@@ -0,0 +1,8 @@
+Without Private DNS configuration, remote users cannot resolve internal domain names through Entra Private Access, forcing them to rely on public DNS servers or manually configure DNS settings. Threat actors can exploit this gap through DNS spoofing attacks, where corrupt DNS data is introduced into resolver caches, causing name servers to return incorrect IP addresses. When users attempt to access internal resources by FQDN without proper DNS resolution through the secure tunnel, threat actors can redirect users from legitimate websites to sites of the attacker's choosing. This enables credential harvesting as users authenticate to what appears to be the correct internal resource but is actually controlled by the threat actor. Through this redirection, threat actors can steal sensitive data from users who believe they are accessing legitimate internal systems. The compromised credentials can then be used to establish persistence within the environment by creating additional access paths or escalating privileges. Without centralized DNS resolution through Private Access, organizations lose visibility into DNS queries and cannot apply consistent security policies, making it harder to detect when threat actors are performing reconnaissance or establishing command and control channels through DNS tunneling. 
+
+**Remediation action**
+
+- [Enable Private DNS and configure DNS suffix segments for internal domains](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-name-resolution)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25405.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25405.md
new file mode 100644
index 000000000000..40ef6074e0d4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25405.md
@@ -0,0 +1,11 @@
+Intelligent Local Access (ILA) is a key capability that merges ZTNA policy enforcement with the efficiency of routing Private Access traffic locally—instead of sending all data through the cloud backend, as is typical with standard Private Access. Using ILA is crucial; otherwise, users may turn off Private Access in the GSA client to boost performance, which would bypass all ZTNA policy controls such as user assignment or Entra ID conditional access.
+
+This verification ensures that private networks are set up within the Entra ID tenant. If private networks exist, the check is successful, indicating that Intelligent Local Access is being used.
+
+**Remediation action**
+
+You should consider configuring one or multiple private networks for your user sites and assigning the appropriate applications to it. This will ensure that private access traffic is routed locally when the user is located at these sites to improve performance while maintaining ZTNA policy enforcement.
+
+- [Enable Intelligent Local Network - Global Secure Access](https://learn.microsoft.com/en-us/entra/global-secure-access/enable-intelligent-local-access?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25406.md b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25406.md
new file mode 100644
index 000000000000..6c579aa18ae3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Devices/Invoke-CippTestZTNA25406.md
@@ -0,0 +1,8 @@
+When the Internet Access forwarding profile remains disabled, users access internet resources without routing traffic through the Secure Web Gateway, bypassing security controls that block threats, malicious content, and unsafe destinations. Threat actors exploit this gap by delivering malware, establishing command and control connections, or exfiltrating data through unmonitored internet channels. Without sufficient controls to prevent unauthorized access, threat actors leverage compromised credentials or social engineering to establish initial access, then use unfiltered internet connectivity to download tools, establish persistence mechanisms, or communicate with external infrastructure. Organizations lose visibility into internet traffic patterns through Traffic Logs, preventing detection of data exfiltration attempts, connections to known malicious domains, or unauthorized access to external resources. The absence of identity-based access controls for internet traffic enables threat actors operating from compromised accounts to blend with normal user behavior, accessing external resources to stage attacks, download exploitation frameworks, or communicate with adversary infrastructure without triggering security alerts based on user context, device compliance, or location.
+
+**Remediation action**
+
+- [Enable Internet Access forwarding profile to route traffic through the Secure Web Gateway](https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-manage-internet-access-profile)
+- [Assign users and groups to the Internet Access profile to scope traffic forwarding to specific users](https://learn.microsoft.com/en-us/entra/global-secure-access/concept-traffic-forwarding)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21770.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21770.md
new file mode 100644
index 000000000000..63936bdc8ea5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21770.md
@@ -0,0 +1,10 @@
+Attackers might exploit valid but inactive applications that still have elevated privileges. These applications can be used to gain initial access without raising alarm because they’re legitimate applications. From there, attackers can use the application privileges to plan or execute other attacks. Attackers might also maintain access by manipulating the inactive application, such as by adding credentials. This persistence ensures that even if their primary access method is detected, they can regain access later.
+
+**Remediation action**
+
+- [Disable privileged service principals](https://learn.microsoft.com/graph/api/serviceprincipal-update?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- Investigate if the application has legitimate use cases
+- [If service principal doesn't have legitimate use cases, delete it](https://learn.microsoft.com/graph/api/serviceprincipal-delete?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21771.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21771.md
new file mode 100644
index 000000000000..198c587988cc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21771.md
@@ -0,0 +1,10 @@
+Attackers might exploit valid but inactive applications that still have elevated privileges. These applications can be used to gain initial access without raising alarm because they're legitimate applications. From there, attackers can use the application privileges to plan or execute other attacks. Attackers might also maintain access by manipulating the inactive application, such as by adding credentials. This persistence ensures that even if their primary access method is detected, they can regain access later.
+
+**Remediation action**
+
+- [Disable inactive privileged service principals](https://learn.microsoft.com/graph/api/serviceprincipal-update?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- Investigate if the application has legitimate use cases. If so, [analyze if a OAuth2 permission is a better fit](https://learn.microsoft.com/entra/identity-platform/v2-app-types?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [If service principal doesn't have legitimate use cases, delete it](https://learn.microsoft.com/graph/api/serviceprincipal-delete?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21772.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21772.md
new file mode 100644
index 000000000000..ef04040bf051
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21772.md
@@ -0,0 +1,16 @@
+Applications that use client secrets might store them in configuration files, hardcode them in scripts, or risk their exposure in other ways. The complexities of secret management make client secrets susceptible to leaks and attractive to attackers. Client secrets, when exposed, provide attackers with the ability to blend their activities with legitimate operations, making it easier to bypass security controls. If an attacker compromises an application's client secret, they can escalate their privileges within the system, leading to broader access and control, depending on the permissions of the application.
+
+Applications and service principals that have permissions for Microsoft Graph APIs or other APIs have a higher risk because an attacker can potentially exploit these additional permissions.
+
+**Remediation action**
+
+- [Move applications away from shared secrets to managed identities and adopt more secure practices](https://learn.microsoft.com/entra/identity/enterprise-apps/migrate-applications-from-secrets?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+   - Use managed identities for Azure resources
+   - Deploy Conditional Access policies for workload identities
+   - Implement secret scanning
+   - Deploy application authentication policies to enforce secure authentication practices
+   - Create a least-privileged custom role to rotate application credentials
+   - Ensure you have a process to triage and monitor applications
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21772.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21772.ps1
new file mode 100644
index 000000000000..8f874c1799bf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21772.ps1
@@ -0,0 +1,58 @@
+function Invoke-CippTestZTNA21772 {
+    <#
+    .SYNOPSIS
+    Applications do not have client secrets configured
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $Apps = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Apps'
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+
+        if (-not $Apps -and -not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21772' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Applications do not have client secrets configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+            return
+        }
+
+        $AppsWithSecrets = @()
+        $SPsWithSecrets = @()
+
+        if ($Apps) {
+            $AppsWithSecrets = $Apps | Where-Object {
+                $_.passwordCredentials -and
+                $_.passwordCredentials.Count -gt 0 -and
+                $_.passwordCredentials -ne '[]'
+            }
+        }
+
+        if ($ServicePrincipals) {
+            $SPsWithSecrets = $ServicePrincipals | Where-Object {
+                $_.passwordCredentials -and
+                $_.passwordCredentials.Count -gt 0 -and
+                $_.passwordCredentials -ne '[]'
+            }
+        }
+
+        $TotalWithSecrets = $AppsWithSecrets.Count + $SPsWithSecrets.Count
+
+        if ($TotalWithSecrets -eq 0) {
+            $Status = 'Passed'
+            $Result = 'Applications in your tenant do not use client secrets'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+Found $($AppsWithSecrets.Count) applications and $($SPsWithSecrets.Count) service principals with client secrets configured
+## Apps with client secrets:
+$(($AppsWithSecrets | ForEach-Object { "- $($_.displayName) (AppId: $($_.appId))" }) -join "`n")
+## Service principals with client secrets:
+$(($SPsWithSecrets | ForEach-Object { "- $($_.displayName) (AppId: $($_.appId))" }) -join "`n")
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21772' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Applications do not have client secrets configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21772' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Applications do not have client secrets configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21773.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21773.md
new file mode 100644
index 000000000000..7e776cd485e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21773.md
@@ -0,0 +1,12 @@
+Certificates, if not securely stored, can be extracted and exploited by attackers, leading to unauthorized access. Long-lived certificates are more likely to be exposed over time. Credentials, when exposed, provide attackers with the ability to blend their activities with legitimate operations, making it easier to bypass security controls. If an attacker compromises an application's certificate, they can escalate their privileges within the system, leading to broader access and control, depending on the privileges of the application.
+
+**Remediation action**
+
+- [Define certificate based application configuration](https://devblogs.microsoft.com/identity/app-management-policy/)
+- [Define trusted certificate authorities for apps and service principals in the tenant](https://learn.microsoft.com/graph/api/resources/certificatebasedapplicationconfiguration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Define application management policies](https://learn.microsoft.com/graph/api/resources/applicationauthenticationmethodpolicy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Enforce secret and certificate standards](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Create a least-privileged custom role to rotate application credentials](https://learn.microsoft.com/entra/identity/role-based-access-control/custom-create?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21773.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21773.ps1
new file mode 100644
index 000000000000..6ce664830428
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21773.ps1
@@ -0,0 +1,88 @@
+function Invoke-CippTestZTNA21773 {
+    <#
+    .SYNOPSIS
+    Applications do not have certificates with expiration longer than 180 days
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $Apps = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Apps'
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+
+        if (-not $Apps -and -not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21773' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Applications do not have certificates with expiration longer than 180 days' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+            return
+        }
+
+        $MaxDate = (Get-Date).AddDays(180)
+        $AppsWithLongCerts = @()
+        $SPsWithLongCerts = @()
+
+        if ($Apps) {
+            $AppsWithLongCerts = $Apps | Where-Object {
+                if ($_.keyCredentials -and $_.keyCredentials.Count -gt 0 -and $_.keyCredentials -ne '[]') {
+                    $HasLongCert = $false
+                    foreach ($Cred in $_.keyCredentials) {
+                        if ($Cred.endDateTime) {
+                            $EndDate = [datetime]$Cred.endDateTime
+                            if ($EndDate -gt $MaxDate) {
+                                $HasLongCert = $true
+                                break
+                            }
+                        }
+                    }
+                    $HasLongCert
+                } else {
+                    $false
+                }
+            }
+        }
+
+        if ($ServicePrincipals) {
+            $SPsWithLongCerts = $ServicePrincipals | Where-Object {
+                if ($_.keyCredentials -and $_.keyCredentials.Count -gt 0 -and $_.keyCredentials -ne '[]') {
+                    $HasLongCert = $false
+                    foreach ($Cred in $_.keyCredentials) {
+                        if ($Cred.endDateTime) {
+                            $EndDate = [datetime]$Cred.endDateTime
+                            if ($EndDate -gt $MaxDate) {
+                                $HasLongCert = $true
+                                break
+                            }
+                        }
+                    }
+                    $HasLongCert
+                } else {
+                    $false
+                }
+            }
+        }
+
+        $TotalWithLongCerts = $AppsWithLongCerts.Count + $SPsWithLongCerts.Count
+
+        if ($TotalWithLongCerts -eq 0) {
+            $Status = 'Passed'
+            $Result = 'Applications in your tenant do not have certificates valid for more than 180 days'
+        } else {
+            $Status = 'Failed'
+            $Result = "Found $($AppsWithLongCerts.Count) applications and $($SPsWithLongCerts.Count) service principals with certificates longer than 180 days`n`n"
+
+            if ($AppsWithLongCerts.Count -gt 0) {
+                $Result += "## Apps with long-lived certificates:`n`n"
+                $Result += ($AppsWithLongCerts | ForEach-Object { "- $($_.displayName) (AppId: $($_.appId))" }) -join "`n"
+                $Result += "`n`n"
+            }
+
+            if ($SPsWithLongCerts.Count -gt 0) {
+                $Result += "## Service principals with long-lived certificates:`n`n"
+                $Result += ($SPsWithLongCerts | ForEach-Object { "- $($_.displayName) (AppId: $($_.appId))" }) -join "`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21773' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Applications do not have certificates with expiration longer than 180 days' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21773' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Applications do not have certificates with expiration longer than 180 days' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21774.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21774.md
new file mode 100644
index 000000000000..71fed1768f8a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21774.md
@@ -0,0 +1,13 @@
+Microsoft services applications that operate in your tenant are identified as service principals with the owner organization ID "f8cdef31-a31e-4b4a-93e4-5f571e91255a." When these service principals have credentials configured in your tenant, they might create potential attack vectors that threat actors can exploit. If an administrator added the credentials and they're no longer needed, they can become a target for attackers. Although less likely when proper preventive and detective controls are in place on privileged activities, threat actors can also maliciously add credentials. In either case, threat actors can use these credentials to authenticate as the service principal, gaining the same permissions and access rights as the Microsoft service application. This initial access can lead to privilege escalation if the application has high-level permissions, allowing lateral movement across the tenant. Attackers can then proceed to data exfiltration or persistence establishment through creating other backdoor credentials.
+
+When credentials (like client secrets or certificates) are configured for these service principals in your tenant, it means someone - either an administrator or a malicious actor - enabled them to authenticate independently within your environment. These credentials should be investigated to determine their legitimacy and necessity. If they're no longer needed, they should be removed to reduce the risk. 
+
+If this check doesn't pass, the recommendation is to "investigate" because you need to identify and review any applications with unused credentials configured.
+
+**Remediation action**
+
+- Confirm if the credentials added are still valid use cases. If not, remove credentials from Microsoft service applications to reduce security risk. 
+    - In the Microsoft Entra admin center, browse to **Entra ID** > **App registrations** and select the affected application.
+    - Go to the **Certificates & secrets** section and remove any credentials that are no longer needed.<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21774.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21774.ps1
new file mode 100644
index 000000000000..659e9c4656b7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21774.ps1
@@ -0,0 +1,61 @@
+function Invoke-CippTestZTNA21774 {
+    <#
+    .SYNOPSIS
+    Microsoft services applications do not have credentials configured
+    #>
+    param($Tenant)
+
+    try {
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+        #tested
+        if (-not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21774' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Microsoft services applications do not have credentials configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+            return
+        }
+
+        $MicrosoftTenantId = 'f8cdef31-a31e-4b4a-93e4-5f571e91255a'
+
+        $MicrosoftSPs = $ServicePrincipals | Where-Object {
+            $_.appOwnerOrganizationId -eq $MicrosoftTenantId
+        }
+
+        $SPsWithPasswordCreds = @()
+        $SPsWithKeyCreds = @()
+
+        if ($MicrosoftSPs) {
+            $SPsWithPasswordCreds = $MicrosoftSPs | Where-Object {
+                $_.passwordCredentials -and
+                $_.passwordCredentials.Count -gt 0 -and
+                $_.passwordCredentials -ne '[]'
+            }
+
+            $SPsWithKeyCreds = $MicrosoftSPs | Where-Object {
+                $_.keyCredentials -and
+                $_.keyCredentials.Count -gt 0 -and
+                $_.keyCredentials -ne '[]'
+            }
+        }
+
+        $TotalWithCreds = $SPsWithPasswordCreds.Count + $SPsWithKeyCreds.Count
+
+        if ($TotalWithCreds -eq 0) {
+            $Status = 'Passed'
+            $Result = 'No Microsoft services applications have credentials configured in the tenant'
+        } else {
+            $Status = 'Investigate'
+            $Result = @"
+Found Microsoft services applications with credentials configured: $($SPsWithPasswordCreds.Count) with password credentials, $($SPsWithKeyCreds.Count) with key credentials
+## Service principals with password credentials:
+$(($SPsWithPasswordCreds | ForEach-Object { "- $($_.displayName) (AppId: $($_.appId))" }) -join "`n")
+## Service principals with key credentials:
+$(($SPsWithKeyCreds | ForEach-Object { "- $($_.displayName) (AppId: $($_.appId))" }) -join "`n")
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21774' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Microsoft services applications do not have credentials configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21774' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Microsoft services applications do not have credentials configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21775.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21775.md
new file mode 100644
index 000000000000..b2245df4e438
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21775.md
@@ -0,0 +1,10 @@
+Without proper application management policies, threat actors can exploit weak or misconfigured application credentials to get unauthorized access to organizational resources. Applications using long-lived password secrets or certificates create extended attack windows where compromised credentials stay valid for extended periods. If an application uses client secrets that are hardcoded in configuration files or have weak password requirements, threat actors can extract these credentials through different means, including source code repositories, configuration dumps, or memory analysis. If threat actors get these credentials, they can perform lateral movement within the environment, escalate privileges if the application has elevated permissions, establish persistence by creating more backdoor credentials, modify application configuration, or exfiltrate data. The lack of credential lifecycle management lets compromised credentials remain active indefinitely, giving threat actors sustained access to organizational assets and the ability to conduct data exfiltration, system manipulation, or deploy more malicious tools without detection. 
+
+Configuring appropriate app management policies helps organizations stay ahead of these threats.
+
+**Remediation action**
+
+- [Learn how to enforce secret and certificate standards using application management policies](https://learn.microsoft.com/entra/identity/enterprise-apps/tutorial-enforce-secret-standards?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21776.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21776.md
new file mode 100644
index 000000000000..9dbaf31c5b70
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21776.md
@@ -0,0 +1,14 @@
+Without restricted user consent settings, threat actors can exploit permissive application consent configurations to gain unauthorized access to sensitive organizational data. When user consent is unrestricted, attackers can:
+
+- Use social engineering and illicit consent grant attacks to trick users into approving malicious applications.
+- Impersonate legitimate services to request broad permissions, such as access to email, files, calendars, and other critical business data.
+- Obtain legitimate OAuth tokens that bypass perimeter security controls, making access appear normal to security monitoring systems.
+- Establish persistent access to organizational resources, conduct reconnaissance across Microsoft 365 services, move laterally through connected systems, and potentially escalate privileges.
+
+Unrestricted user consent also limits an organization's ability to enforce centralized governance over application access, making it difficult to maintain visibility into which non-Microsoft applications have access to sensitive data. This gap creates compliance risks where unauthorized applications might violate data protection regulations or organizational security policies.
+
+**Remediation action**
+
+-  [Configure restricted user consent settings](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) to prevent illicit consent grants by disabling user consent or limiting it to verified publishers with low-risk permissions only.<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21776.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21776.ps1
new file mode 100644
index 000000000000..88752ce98bd3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21776.ps1
@@ -0,0 +1,33 @@
+function Invoke-CippTestZTNA21776 {
+    <#
+    .SYNOPSIS
+    User consent settings are restricted
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $AuthPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+        if (-not $AuthPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21776' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'User consent settings are restricted' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Application Management'
+            return
+        }
+
+        $Matched = $AuthPolicy | Where-Object { $_.defaultUserRolePermissions.permissionGrantPoliciesAssigned -match '^ManagePermissionGrantsForSelf' }
+        $NoMatch = $Matched.Count -eq 0
+        $LowImpact = $Matched.defaultUserRolePermissions.permissionGrantPoliciesAssigned -contains 'managePermissionGrantsForSelf.microsoft-user-default-low'
+
+        if ($NoMatch -or $LowImpact) {
+            $Status = 'Passed'
+            $Result = if ($NoMatch) { 'User consent is disabled' } else { 'User consent restricted to verified publishers and low-impact permissions' }
+        } else {
+            $Status = 'Failed'
+            $Result = 'Users can consent to any application'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21776' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'User consent settings are restricted' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21776' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'User consent settings are restricted' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21777.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21777.md
new file mode 100644
index 000000000000..7f418136d2ed
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21777.md
@@ -0,0 +1,8 @@
+App instance property lock prevents changes to sensitive properties of a multitenant application after the application is provisioned in another tenant. Without a lock, critical properties such as application credentials can be maliciously or unintentionally modified, causing disruptions, increased risk, unauthorized access, or privilege escalations.
+
+**Remediation action**
+Enable the app instance property lock for all multitenant applications and specify the properties to lock.
+- [Configure an app instance lock](https://learn.microsoft.com/en-us/entra/identity-platform/howto-configure-app-instance-property-locks?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-an-app-instance-lock)   
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21778.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21778.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21778.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21779.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21779.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21779.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21780.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21780.md
new file mode 100644
index 000000000000..f3911fd1bf14
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21780.md
@@ -0,0 +1,8 @@
+Microsoft ended support and security fixes for ADAL on June 30, 2023. Continued ADAL usage bypasses modern security protections available only in MSAL, including Conditional Access enforcement, Continuous Access Evaluation (CAE), and advanced token protection. ADAL applications create security vulnerabilities by using weaker legacy authentication patterns, often calling deprecated Azure AD Graph endpoints, and preventing adoption of hardened authentication flows that could mitigate future security advisories. 
+
+**Remediation action**
+
+- [Migrate applications to the Microsoft Authentication Library (MSAL)](https://learn.microsoft.com/entra/identity-platform/msal-migration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21780.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21780.ps1
new file mode 100644
index 000000000000..cb4567b0b95f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21780.ps1
@@ -0,0 +1,38 @@
+function Invoke-CippTestZTNA21780 {
+    <#
+    .SYNOPSIS
+    No usage of ADAL in the tenant
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $Recommendations = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DirectoryRecommendations'
+
+        if (-not $Recommendations) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21780' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'No usage of ADAL in the tenant' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application Management'
+            return
+        }
+
+        $AdalRecommendations = $Recommendations | Where-Object {
+            $_.recommendationType -eq 'adalToMsalMigration'
+        }
+
+        if ($AdalRecommendations.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = 'No ADAL applications found in the tenant'
+        } else {
+            $Status = 'Failed'
+            $Result = @"
+            Found $($AdalRecommendations.Count) ADAL applications in the tenant that need migration to MSAL.
+            ADAL Applications:
+            $(($AdalRecommendations | ForEach-Object { "- $($_.applicationDisplayName) (AppId: $($_.applicationId))" }) -join "`n")
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21780' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'No usage of ADAL in the tenant' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21780' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'No usage of ADAL in the tenant' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21781.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21781.md
new file mode 100644
index 000000000000..4a9fec301780
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21781.md
@@ -0,0 +1,13 @@
+Without phishing-resistant authentication methods, privileged users are more vulnerable to phishing attacks. These types of attacks trick users into revealing their credentials to grant unauthorized access to attackers. If non-phishing-resistant authentication methods are used, attackers might intercept credentials and tokens, through methods like adversary-in-the-middle attacks, undermining the security of the privileged account.
+
+Once a privileged account or session is compromised due to weak authentication methods, attackers might manipulate the account to maintain long-term access, create other backdoors, or modify user permissions. Attackers can also use the compromised privileged account to escalate their access even further, potentially gaining control over more sensitive systems.
+
+**Remediation action**
+
+- [Get started with a phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Ensure that privileged accounts register and use phishing resistant methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-strengths)
+- [Deploy a Conditional Access policy to target privileged accounts and require phishing resistant credentials](https://learn.microsoft.com/entra/identity/conditional-access/policy-admin-phish-resistant-mfa?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Monitor authentication method activity](https://learn.microsoft.com/entra/identity/monitoring-health/concept-usage-insights-report?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-methods-activity)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.md
new file mode 100644
index 000000000000..4a9fec301780
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.md
@@ -0,0 +1,13 @@
+Without phishing-resistant authentication methods, privileged users are more vulnerable to phishing attacks. These types of attacks trick users into revealing their credentials to grant unauthorized access to attackers. If non-phishing-resistant authentication methods are used, attackers might intercept credentials and tokens, through methods like adversary-in-the-middle attacks, undermining the security of the privileged account.
+
+Once a privileged account or session is compromised due to weak authentication methods, attackers might manipulate the account to maintain long-term access, create other backdoors, or modify user permissions. Attackers can also use the compromised privileged account to escalate their access even further, potentially gaining control over more sensitive systems.
+
+**Remediation action**
+
+- [Get started with a phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Ensure that privileged accounts register and use phishing resistant methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-strengths)
+- [Deploy a Conditional Access policy to target privileged accounts and require phishing resistant credentials](https://learn.microsoft.com/entra/identity/conditional-access/policy-admin-phish-resistant-mfa?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Monitor authentication method activity](https://learn.microsoft.com/entra/identity/monitoring-health/concept-usage-insights-report?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-methods-activity)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1
new file mode 100644
index 000000000000..40441197b262
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1
@@ -0,0 +1,94 @@
+function Invoke-CippTestZTNA21782 {
+    <#
+    .SYNOPSIS
+    Privileged accounts have phishing-resistant methods registered
+    #>
+    param($Tenant)
+
+    try {
+        $UserRegistrationDetails = New-CIPPDbRequest -TenantFilter $Tenant -Type 'UserRegistrationDetails'
+        $RoleAssignments = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleAssignments'
+
+        if (-not $UserRegistrationDetails -or -not $RoleAssignments) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21782' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Privileged accounts have phishing-resistant methods registered' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged Access'
+            return
+        }
+
+        $PhishResistantMethods = @('passKeyDeviceBound', 'passKeyDeviceBoundAuthenticator', 'windowsHelloForBusiness')
+
+        # Join user registration details with role assignments
+        $results = $UserRegistrationDetails | Where-Object {
+            $userId = $_.id
+            $RoleAssignments | Where-Object { $_.principalId -eq $userId }
+        } | ForEach-Object {
+            $user = $_
+            $userRoles = $RoleAssignments | Where-Object { $_.principalId -eq $user.id }
+            $hasPhishResistant = $false
+
+            if ($user.methodsRegistered) {
+                foreach ($method in $PhishResistantMethods) {
+                    if ($user.methodsRegistered -contains $method) {
+                        $hasPhishResistant = $true
+                        break
+                    }
+                }
+            }
+
+            [PSCustomObject]@{
+                id                       = $user.id
+                userDisplayName          = $user.userDisplayName
+                roleDisplayName          = ($userRoles.roleDefinitionName -join ', ')
+                methodsRegistered        = $user.methodsRegistered
+                phishResistantAuthMethod = $hasPhishResistant
+            }
+        }
+
+        $totalUserCount = $results.Length
+        $phishResistantPrivUsers = $results | Where-Object { $_.phishResistantAuthMethod }
+        $phishablePrivUsers = $results | Where-Object { !$_.phishResistantAuthMethod }
+
+        $phishResistantPrivUserCount = $phishResistantPrivUsers.Length
+
+        $passed = $totalUserCount -eq $phishResistantPrivUserCount
+
+        $testResultMarkdown = if ($passed) {
+            "Validated that all privileged users have registered phishing resistant authentication methods.`n`n%TestResult%"
+        } else {
+            "Found privileged users that have not yet registered phishing resistant authentication methods`n`n%TestResult%"
+        }
+
+        $mdInfo = "## Privileged users`n`n"
+
+        if ($passed) {
+            $mdInfo = "All privileged users have registered phishing resistant authentication methods.`n`n"
+        } else {
+            $mdInfo = "Found privileged users that have not registered phishing resistant authentication methods.`n`n"
+        }
+
+        $mdInfo = $mdInfo + "| User | Role Name | Phishing resistant method registered |`n"
+        $mdInfo = $mdInfo + "| :--- | :--- | :---: |`n"
+
+        $userLinkFormat = 'https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/UserAuthMethods/userId/{0}/hidePreviewBanner~/true'
+
+        $mdLines = @($phishablePrivUsers | Sort-Object userDisplayName | ForEach-Object {
+                $userLink = $userLinkFormat -f $_.id
+                "|[$($_.userDisplayName)]($userLink)| $($_.roleDisplayName) | ❌ |`n"
+            })
+        $mdInfo = $mdInfo + ($mdLines -join '')
+
+        $mdLines = @($phishResistantPrivUsers | Sort-Object userDisplayName | ForEach-Object {
+                $userLink = $userLinkFormat -f $_.id
+                "|[$($_.userDisplayName)]($userLink)| $($_.roleDisplayName) | ✅ |`n"
+            })
+        $mdInfo = $mdInfo + ($mdLines -join '')
+
+        $testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21782' -TestType 'Identity' -Status $(if ($passed) { 'Passed' } else { 'Failed' }) -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Privileged accounts have phishing-resistant methods registered' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged Access'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21782' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Privileged accounts have phishing-resistant methods registered' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged Access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21783.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21783.md
new file mode 100644
index 000000000000..4a9fec301780
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21783.md
@@ -0,0 +1,13 @@
+Without phishing-resistant authentication methods, privileged users are more vulnerable to phishing attacks. These types of attacks trick users into revealing their credentials to grant unauthorized access to attackers. If non-phishing-resistant authentication methods are used, attackers might intercept credentials and tokens, through methods like adversary-in-the-middle attacks, undermining the security of the privileged account.
+
+Once a privileged account or session is compromised due to weak authentication methods, attackers might manipulate the account to maintain long-term access, create other backdoors, or modify user permissions. Attackers can also use the compromised privileged account to escalate their access even further, potentially gaining control over more sensitive systems.
+
+**Remediation action**
+
+- [Get started with a phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Ensure that privileged accounts register and use phishing resistant methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-strengths)
+- [Deploy a Conditional Access policy to target privileged accounts and require phishing resistant credentials](https://learn.microsoft.com/entra/identity/conditional-access/policy-admin-phish-resistant-mfa?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Monitor authentication method activity](https://learn.microsoft.com/entra/identity/monitoring-health/concept-usage-insights-report?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-methods-activity)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21783.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21783.ps1
new file mode 100644
index 000000000000..1749977c6dee
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21783.ps1
@@ -0,0 +1,56 @@
+function Invoke-CippTestZTNA21783 {
+    <#
+    .SYNOPSIS
+    Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+        $Roles = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Roles'
+
+        if (-not $CAPolicies -or -not $Roles) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21783' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+            return
+        }
+
+        $PrivilegedRoles = $Roles | Where-Object { $_.isPrivileged -and $_.isBuiltIn }
+
+        if (-not $PrivilegedRoles) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21783' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No privileged built-in roles found in tenant' -Risk 'High' -Name 'Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+            return
+        }
+
+        $PhishResistantMethods = @('windowsHelloForBusiness', 'fido2', 'x509CertificateMultiFactor')
+
+        $PhishResistantPolicies = $CAPolicies | Where-Object {
+            $_.state -eq 'enabled' -and
+            $_.grantControls.authenticationStrength -and
+            $_.conditions.users.includeRoles
+        }
+
+        $CoveredRoleIds = $PhishResistantPolicies.conditions.users.includeRoles | Select-Object -Unique
+
+        $UnprotectedRoles = $PrivilegedRoles | Where-Object { $_.id -notin $CoveredRoleIds }
+
+        if ($UnprotectedRoles.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = "All $($PrivilegedRoles.Count) privileged built-in roles are protected by Conditional Access policies enforcing phishing-resistant authentication"
+        } else {
+            $Status = 'Failed'
+            $UnprotectedCount = $UnprotectedRoles.Count
+            $ProtectedCount = $PrivilegedRoles.Count - $UnprotectedCount
+            $Result = @"
+Found $UnprotectedCount unprotected privileged roles out of $($PrivilegedRoles.Count) total ($ProtectedCount protected)
+## Unprotected privileged roles:
+$(($UnprotectedRoles | ForEach-Object { "- $($_.displayName)" }) -join "`n")
+"@
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21783' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21783' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Privileged Microsoft Entra built-in roles are targeted with Conditional Access policies to enforce phishing-resistant methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21784.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21784.md
new file mode 100644
index 000000000000..49b91b174bf7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21784.md
@@ -0,0 +1,12 @@
+## Description
+
+Verifies that all user sign-ins are protected by Conditional Access policies requiring phishing-resistant authentication methods (Windows Hello for Business, FIDO2 security keys, or certificate-based authentication).
+
+**Remediation action**
+
+- [Configure Conditional Access policies to enforce phishing-resistant authentication](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength)
+
+- [Deploy phishing-resistant authentication methods](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-deploy-phishing-resistant-passwordless-authentication)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21784.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21784.ps1
new file mode 100644
index 000000000000..3df5ac94ee3b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21784.ps1
@@ -0,0 +1,73 @@
+function Invoke-CippTestZTNA21784 {
+    <#
+    .SYNOPSIS
+    All user sign in activity uses phishing-resistant authentication methods
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $CAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21784' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'All user sign in activity uses phishing-resistant authentication methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+            return
+        }
+
+        # Get authentication strength policies from cache
+        $AuthStrengthPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationStrengths'
+
+        # Define phishing-resistant methods
+        $PhishingResistantMethods = @(
+            'windowsHelloForBusiness',
+            'fido2',
+            'x509CertificateMultiFactor',
+            'certificateBasedAuthenticationPki'
+        )
+
+        # Find authentication strength policies with phishing-resistant methods
+        $PhishingResistantPolicies = $AuthStrengthPolicies | Where-Object {
+            $_.allowedCombinations | Where-Object { $PhishingResistantMethods -contains $_ }
+        }
+
+        if (-not $PhishingResistantPolicies) {
+            $Status = 'Failed'
+            $Result = 'No phishing-resistant authentication strength policies found in tenant'
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21784' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'All user sign in activity uses phishing-resistant authentication methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+            return
+        }
+
+        $EnabledPolicies = $CAPolicies | Where-Object { $_.state -eq 'enabled' }
+
+        # Find policies that apply to all users with phishing-resistant auth strength
+        $RelevantPolicies = $EnabledPolicies | Where-Object {
+            ($_.conditions.users.includeUsers -contains 'All') -and
+            ($_.grantControls.authenticationStrength.id -in $PhishingResistantPolicies.id)
+        }
+
+        if (-not $RelevantPolicies) {
+            $Status = 'Failed'
+            $Result = 'No Conditional Access policies found requiring phishing-resistant authentication for all users'
+        } else {
+            # Check for user exclusions that create coverage gaps
+            $PoliciesWithExclusions = $RelevantPolicies | Where-Object {
+                $_.conditions.users.excludeUsers.Count -gt 0
+            }
+
+            if ($PoliciesWithExclusions.Count -gt 0) {
+                $Status = 'Failed'
+                $Result = "Found $($RelevantPolicies.Count) policies requiring phishing-resistant authentication, but $($PoliciesWithExclusions.Count) have user exclusions creating coverage gaps:`n`n"
+                $Result += ($PoliciesWithExclusions | ForEach-Object { "- $($_.displayName) (Excludes $($_.conditions.users.excludeUsers.Count) users)" }) -join "`n"
+            } else {
+                $Status = 'Passed'
+                $Result = "All users are protected by $($RelevantPolicies.Count) Conditional Access policies requiring phishing-resistant authentication:`n`n"
+                $Result += ($RelevantPolicies | ForEach-Object { "- $($_.displayName)" }) -join "`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21784' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'All user sign in activity uses phishing-resistant authentication methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21784' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'All user sign in activity uses phishing-resistant authentication methods' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access Control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21786.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21786.md
new file mode 100644
index 000000000000..9687b064b0dc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21786.md
@@ -0,0 +1,10 @@
+A threat actor can intercept or extract authentication tokens from memory, local storage on a legitimate device, or by inspecting network traffic. The attacker might replay those tokens to bypass authentication controls on users and devices, get unauthorized access to sensitive data, or run further attacks. Because these tokens are valid and time bound, traditional anomaly detection often fails to flag the activity, which might allow sustained access until the token expires or is revoked.
+
+Token protection, also called token binding, helps prevent token theft by making sure a token is usable only from the intended device. Token protection uses cryptography so that without the client device key, no one can use the token.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to require token protection](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21786.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21786.ps1
new file mode 100644
index 000000000000..f44d613a07e4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21786.ps1
@@ -0,0 +1,41 @@
+function Invoke-CippTestZTNA21786 {
+    <#
+    .SYNOPSIS
+    User sign-in activity uses token protection
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $CAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21786' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'User sign-in activity uses token protection' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access Control'
+            return
+        }
+
+        $TokenProtectionPolicies = $CAPolicies | Where-Object {
+            $_.state -eq 'enabled' -and
+            $_.conditions.clientAppTypes.Count -eq 1 -and
+            $_.conditions.clientAppTypes[0] -eq 'mobileAppsAndDesktopClients' -and
+            $_.conditions.applications.includeApplications -contains '00000002-0000-0ff1-ce00-000000000000' -and
+            $_.conditions.applications.includeApplications -contains '00000003-0000-0ff1-ce00-000000000000' -and
+            $_.conditions.platforms.includePlatforms.Count -eq 1 -and
+            $_.conditions.platforms.includePlatforms -eq 'windows' -and
+            $_.sessionControls.secureSignInSession.isEnabled -eq $true
+        }
+
+        if ($TokenProtectionPolicies.Count -gt 0) {
+            $Status = 'Passed'
+            $Result = "Found $($TokenProtectionPolicies.Count) token protection policies properly configured"
+        } else {
+            $Status = 'Failed'
+            $Result = 'No properly configured token protection policies found'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21786' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'User sign-in activity uses token protection' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access Control'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21786' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'User sign-in activity uses token protection' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access Control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21787.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21787.md
new file mode 100644
index 000000000000..b6a91771ec1e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21787.md
@@ -0,0 +1,12 @@
+A threat actor or a well-intentioned but uninformed employee can create a new Microsoft Entra tenant if there are no restrictions in place. By default, the user who creates a tenant is automatically assigned the Global Administrator role. Without proper controls, this action fractures the identity perimeter by creating a tenant outside the organization's governance and visibility. It introduces risk though a shadow identity platform that can be exploited for token issuance, brand impersonation, consent phishing, or persistent staging infrastructure. Since the rogue tenant might not be tethered to the enterprise’s administrative or monitoring planes, traditional defenses are blind to its creation, activity, and potential misuse.
+
+**Remediation action**
+
+Enable the **Restrict non-admin users from creating tenants** setting. For users that need the ability to create tenants, assign them the Tenant Creator role. You can also review tenant creation events in the Microsoft Entra audit logs.
+
+- [Restrict member users' default permissions](https://learn.microsoft.com/entra/fundamentals/users-default-permissions?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#restrict-member-users-default-permissions)
+- [Assign the Tenant Creator role](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#tenant-creator)
+- [Review tenant creation events](https://learn.microsoft.com/entra/identity/monitoring-health/reference-audit-activities?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#core-directory). Look for OperationName=="Create Company", Category == "DirectoryManagement".
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21787.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21787.ps1
new file mode 100644
index 000000000000..0e0a9223dc11
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21787.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestZTNA21787 {
+    <#
+    .SYNOPSIS
+    Permissions to create new tenants are limited to the Tenant Creator role
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $AuthPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21787' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Permissions to create new tenants are limited to the Tenant Creator role' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Privileged Access'
+            return
+        }
+
+        $CanCreateTenants = $AuthPolicy.defaultUserRolePermissions.allowedToCreateTenants
+
+        if ($CanCreateTenants -eq $false) {
+            $Status = 'Passed'
+            $Result = 'Non-privileged users are restricted from creating tenants'
+        } else {
+            $Status = 'Failed'
+            $Result = 'Non-privileged users are allowed to create tenants'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21787' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Permissions to create new tenants are limited to the Tenant Creator role' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Privileged Access'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21787' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Permissions to create new tenants are limited to the Tenant Creator role' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Privileged Access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21788.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21788.md
new file mode 100644
index 000000000000..1c232fd4b0fe
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21788.md
@@ -0,0 +1,13 @@
+Global Administrators with persistent access to Azure subscriptions expand the attack surface for threat actors. If a Global Administrator account is compromised, attackers can immediately enumerate resources, modify configurations, assign roles, and exfiltrate sensitive data across all subscriptions. Requiring just-in-time elevation for subscription access introduces detectable signals, slows attacker velocity, and routes high-impact operations through observable control points.
+
+**Remediation action**
+
+- [Get started with a phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+- [Ensure that privileged accounts register and use phishing resistant methods](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strengths?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-strengths.md)
+
+- [Deploy Conditional Access policy to target privileged accounts and require phishing resistant credentials using authentication strengths](https://learn.microsoft.com/entra/identity/conditional-access/policy-admin-phish-resistant-mfa?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+
+- [Monitor authentication method activity](https://learn.microsoft.com/entra/identity/monitoring-health/concept-usage-insights-report?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-methods-activity.md)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21789.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21789.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21789.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21790.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21790.md
new file mode 100644
index 000000000000..d434ab123c6f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21790.md
@@ -0,0 +1,11 @@
+Allowing unrestricted external collaboration with unverified organizations can increase the risk surface area of the tenant because it allows guest accounts that might not have proper security controls. Threat actors can attempt to gain access by compromising identities in these loosely governed external tenants. Once granted guest access, they can then use legitimate collaboration pathways to infiltrate resources in your tenant and attempt to gain sensitive information. Threat actors can also exploit misconfigured permissions to escalate privileges and try different types of attacks.
+
+Without vetting the security of organizations you collaborate with, malicious external accounts can persist undetected, exfiltrate confidential data, and inject malicious payloads. This type of exposure can weaken organizational control and enable cross-tenant attacks that bypass traditional perimeter defenses and undermine both data integrity and operational resilience. Cross-tenant settings for outbound access in Microsoft Entra provide the ability to block collaboration with unknown organizations by default, reducing the attack surface.
+
+**Remediation action**
+
+- [Cross-tenant access overview](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Configure cross-tenant access settings](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-settings-b2b-collaboration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-default-settings)
+- [Modify outbound access settings](https://learn.microsoft.com/en-us/entra/external-id/cross-tenant-access-settings-b2b-collaboration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21790.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21790.ps1
new file mode 100644
index 000000000000..d9aa7a95f316
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21790.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestZTNA21790 {
+    <#
+    .SYNOPSIS
+    Outbound cross-tenant access settings are configured
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $CrossTenantPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'CrossTenantAccessPolicy'
+
+        if (-not $CrossTenantPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21790' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Outbound cross-tenant access settings are configured' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Application Management'
+            return
+        }
+
+        $B2BCollabOutbound = $CrossTenantPolicy.b2bCollaborationOutbound.usersAndGroups.accessType -eq 'blocked' -and
+        $CrossTenantPolicy.b2bCollaborationOutbound.usersAndGroups.targets[0].target -eq 'AllUsers' -and
+        $CrossTenantPolicy.b2bCollaborationOutbound.applications.accessType -eq 'blocked' -and
+        $CrossTenantPolicy.b2bCollaborationOutbound.applications.targets[0].target -eq 'AllApplications'
+
+        $B2BDirectOutbound = $CrossTenantPolicy.b2bDirectConnectOutbound.usersAndGroups.accessType -eq 'blocked' -and
+        $CrossTenantPolicy.b2bDirectConnectOutbound.usersAndGroups.targets[0].target -eq 'AllUsers' -and
+        $CrossTenantPolicy.b2bDirectConnectOutbound.applications.accessType -eq 'blocked' -and
+        $CrossTenantPolicy.b2bDirectConnectOutbound.applications.targets[0].target -eq 'AllApplications'
+
+        if ($B2BCollabOutbound -and $B2BDirectOutbound) {
+            $Status = 'Passed'
+            $Result = 'Default cross-tenant access outbound policy blocks all access'
+        } else {
+            $Status = 'Failed'
+            $Result = 'Default cross-tenant access outbound policy has unrestricted access'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21790' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Outbound cross-tenant access settings are configured' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21790' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Outbound cross-tenant access settings are configured' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21791.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21791.md
new file mode 100644
index 000000000000..7e85d896cdfa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21791.md
@@ -0,0 +1,10 @@
+External user accounts are often used to provide access to business partners who belong to organizations that have a business relationship with your enterprise. If these accounts are compromised in their organization, attackers can use the valid credentials to gain initial access to your environment, often bypassing traditional defenses due to their legitimacy.  
+
+Allowing external users to onboard other external users increases the risk of unauthorized access. If an attacker compromises an external user's account, they can use it to create more external accounts, multiplying their access points and making it harder to detect the intrusion.
+
+**Remediation action**
+
+- [Restrict who can invite guests to only users assigned to specific admin roles](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#to-configure-guest-invite-settings)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21791.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21791.ps1
new file mode 100644
index 000000000000..870346bf350b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21791.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestZTNA21791 {
+    <#
+    .SYNOPSIS
+    Guests cannot invite other guests
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $AuthPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21791' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Guests cannot invite other guests' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'External Collaboration'
+            return
+        }
+
+        $AllowInvitesFrom = $AuthPolicy.allowInvitesFrom
+
+        if ($AllowInvitesFrom -ne 'everyone') {
+            $Status = 'Passed'
+            $Result = "Tenant restricts who can invite guests (Set to: $AllowInvitesFrom)"
+        } else {
+            $Status = 'Failed'
+            $Result = 'Tenant allows any user including guests to invite other guests'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21791' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Guests cannot invite other guests' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'External Collaboration'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21791' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guests cannot invite other guests' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'External Collaboration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21792.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21792.md
new file mode 100644
index 000000000000..e3d4505e32c7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21792.md
@@ -0,0 +1,10 @@
+External user accounts are often used to provide access to business partners who belong to organizations that have a business relationship with your enterprise. If these accounts are compromised in their organization, attackers can use the valid credentials to gain initial access to your environment, often bypassing traditional defenses due to their legitimacy.  
+
+External accounts with permissions to read directory object permissions provide attackers with broader initial access if compromised. These accounts allow attackers to gather additional information from the directory for reconnaissance.
+
+**Remediation action**
+
+- [Restrict guest access to their own directory objects](https://learn.microsoft.com/entra/external-id/external-collaboration-settings-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#to-configure-guest-user-access)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21792.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21792.ps1
new file mode 100644
index 000000000000..037e94fe2a3b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21792.ps1
@@ -0,0 +1,33 @@
+function Invoke-CippTestZTNA21792 {
+    <#
+    .SYNOPSIS
+    Guests have restricted access to directory objects
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $AuthPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21792' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Guests have restricted access to directory objects' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'External Collaboration'
+            return
+        }
+
+        $GuestRestrictedRoleId = '2af84b1e-32c8-42b7-82bc-daa82404023b'
+        $GuestRoleId = $AuthPolicy.guestUserRoleId
+
+        if ($GuestRoleId -eq $GuestRestrictedRoleId) {
+            $Status = 'Passed'
+            $Result = 'Guest user access is properly restricted'
+        } else {
+            $Status = 'Failed'
+            $Result = 'Guest user access is not restricted'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21792' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Guests have restricted access to directory objects' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'External Collaboration'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21792' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guests have restricted access to directory objects' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'External Collaboration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21793.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21793.md
new file mode 100644
index 000000000000..fe4e0f3ea03f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21793.md
@@ -0,0 +1,10 @@
+Tenant Restrictions v2 (TRv2) allows organizations to enforce policies that restrict access to specified Microsoft Entra tenants, preventing unauthorized exfiltration of corporate data to external tenants using local accounts. Without TRv2, threat actors can exploit this vulnerability, which leads to potential data exfiltration and compliance violations, followed by credential harvesting if those external tenants have weaker controls. Once credentials are obtained, threat actors can gain initial access to these external tenants. TRv2 provides the mechanism to prevent users from authenticating to unauthorized tenants. Otherwise, threat actors can move laterally, escalate privileges, and potentially exfiltrate sensitive data, all while appearing as legitimate user activity that bypasses traditional data loss prevention controls focused on internal tenant monitoring.
+
+Implementing TRv2 enforces policies that restrict access to specified tenants, mitigating these risks by ensuring that authentication and data access are confined to authorized tenants only. 
+
+If this check passes, your tenant has a TRv2 policy configured but more steps are required to validate the scenario end-to-end.
+
+**Remediation action**
+- [Set up Tenant Restrictions v2](https://learn.microsoft.com/en-us/entra/external-id/tenant-restrictions-v2?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21793.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21793.ps1
new file mode 100644
index 000000000000..3c21654fbc66
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21793.ps1
@@ -0,0 +1,43 @@
+function Invoke-CippTestZTNA21793 {
+    <#
+    .SYNOPSIS
+    Tenant restrictions v2 policy is configured
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $CrossTenantPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'CrossTenantAccessPolicy'
+
+        if (-not $CrossTenantPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21793' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Tenant restrictions v2 policy is configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+            return
+        }
+
+        $TenantRestrictions = $CrossTenantPolicy.tenantRestrictions
+
+        if (-not $TenantRestrictions) {
+            $Status = 'Failed'
+            $Result = 'Tenant Restrictions v2 policy is not configured'
+        } else {
+            $UsersBlocked = $TenantRestrictions.usersAndGroups.accessType -eq 'blocked' -and
+            $TenantRestrictions.usersAndGroups.targets[0].target -eq 'AllUsers'
+
+            $AppsBlocked = $TenantRestrictions.applications.accessType -eq 'blocked' -and
+            $TenantRestrictions.applications.targets[0].target -eq 'AllApplications'
+
+            if ($UsersBlocked -and $AppsBlocked) {
+                $Status = 'Passed'
+                $Result = 'Tenant Restrictions v2 policy is properly configured'
+            } else {
+                $Status = 'Failed'
+                $Result = 'Tenant Restrictions v2 policy is configured but not properly restricting all users and applications'
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21793' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Tenant restrictions v2 policy is configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21793' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Tenant restrictions v2 policy is configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21795.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21795.md
new file mode 100644
index 000000000000..7e00a1e3cb84
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21795.md
@@ -0,0 +1,16 @@
+Legacy authentication protocols such as basic authentication for SMTP and IMAP don't support modern security features like multifactor authentication (MFA), which is crucial for protecting against unauthorized access. This lack of protection makes accounts using these protocols vulnerable to password-based attacks, and provides attackers with a means to gain initial access using stolen or guessed credentials.
+
+When an attacker successfully gains unauthorized access to credentials, they can use them to access linked services, using the weak authentication method as an entry point. Attackers who gain access through legacy authentication might make changes to Microsoft Exchange, such as configuring mail forwarding rules or changing other settings, allowing them to maintain continued access to sensitive communications.
+
+Legacy authentication also provides attackers with a consistent method to reenter a system using compromised credentials without triggering security alerts or requiring reauthentication.
+
+From there, attackers can use legacy protocols to access other systems that are accessible via the compromised account, facilitating lateral movement. Attackers using legacy protocols can blend in with legitimate user activities, making it difficult for security teams to distinguish between normal usage and malicious behavior.
+
+**Remediation action**
+
+- [Exchange protocols can be deactivated in Exchange](https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/disable-basic-authentication-in-exchange-online?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Legacy authentication protocols can be blocked with Conditional Access](https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Sign-ins using legacy authentication workbook to help determine whether it's safe to turn off legacy authentication](https://learn.microsoft.com/entra/identity/monitoring-health/workbook-legacy-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21796.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21796.md
new file mode 100644
index 000000000000..cef984099328
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21796.md
@@ -0,0 +1,14 @@
+Legacy authentication protocols such as basic authentication for SMTP and IMAP don't support modern security features like multifactor authentication (MFA), which is crucial for protecting against unauthorized access. This lack of protection makes accounts using these protocols vulnerable to password-based attacks, and provides attackers with a means to gain initial access using stolen or guessed credentials.
+
+When an attacker successfully gains unauthorized access to credentials, they can use them to access linked services, using the weak authentication method as an entry point. Attackers who gain access through legacy authentication might make changes to Microsoft Exchange, such as configuring mail forwarding rules or changing other settings, allowing them to maintain continued access to sensitive communications.
+
+Legacy authentication also provides attackers with a consistent method to reenter a system using compromised credentials without triggering security alerts or requiring reauthentication.
+
+From there, attackers can use legacy protocols to access other systems that are accessible via the compromised account, facilitating lateral movement. Attackers using legacy protocols can blend in with legitimate user activities, making it difficult for security teams to distinguish between normal usage and malicious behavior.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to Block legacy authentication](https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21796.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21796.ps1
new file mode 100644
index 000000000000..88695f31b7c4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21796.ps1
@@ -0,0 +1,44 @@
+function Invoke-CippTestZTNA21796 {
+    <#
+    .SYNOPSIS
+    Block legacy authentication policy is configured
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $CAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21796' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Block legacy authentication policy is configured' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Access Control'
+            return
+        }
+
+        $BlockPolicies = $CAPolicies | Where-Object {
+            $_.grantControls.builtInControls -contains 'block' -and
+            $_.conditions.clientAppTypes -contains 'exchangeActiveSync' -and
+            $_.conditions.clientAppTypes -contains 'other'
+        }
+
+        $EnabledBlockPolicies = $BlockPolicies | Where-Object {
+            $_.conditions.users.includeUsers -contains 'All' -and
+            $_.state -eq 'enabled'
+        }
+
+        if ($EnabledBlockPolicies.Count -ge 1) {
+            $Status = 'Passed'
+            $Result = "Found $($EnabledBlockPolicies.Count) properly configured policies blocking legacy authentication:`n $($EnabledBlockPolicies | ForEach-Object { "- $($_.displayName)" } | Out-String) "
+        } elseif ($BlockPolicies.Count -ge 1) {
+            $Status = 'Failed'
+            $Result = "Policies to block legacy authentication found but not properly configured or enabled: `n $($BlockPolicies | ForEach-Object { "- $($_.displayName)" } | Out-String) "
+        } else {
+            $Status = 'Failed'
+            $Result = 'No conditional access policies to block legacy authentication found'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21796' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Block legacy authentication policy is configured' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Access Control'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21796' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Block legacy authentication policy is configured' -UserImpact 'High' -ImplementationEffort 'Low' -Category 'Access Control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21797.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21797.md
new file mode 100644
index 000000000000..5f34835602c2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21797.md
@@ -0,0 +1,13 @@
+Assume high risk users are compromised by threat actors. Without investigation and remediation, threat actors can execute scripts, deploy malicious applications, or manipulate API calls to establish persistence, based on the potentially compromised user's permissions. Threat actors can then exploit misconfigurations or abuse OAuth tokens to move laterally across workloads like documents, SaaS applications, or Azure resources. Threat actors can gain access to sensitive files, customer records, or proprietary code and exfiltrate it to external repositories while maintaining stealth through legitimate cloud services. Finally, threat actors might disrupt operations by modifying configurations, encrypting data for ransom, or using the stolen information for further attacks, resulting in financial, reputational, and regulatory consequences.
+
+Organizations using passwords can rely on password reset to automatically remediate risky users.
+
+Organizations using passwordless credentials already mitigate most risk events that accrue to user risk levels, thus the volume of risky users should be considerably lower. Risky users in an organization that uses passwordless credentials must be blocked from access until the user risk is investigated and remediated.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to require a secure password change for elevated user risk](https://learn.microsoft.com/entra/identity/conditional-access/policy-risk-based-user?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+- Use Microsoft Entra ID Protection to [investigate risk further](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-investigate-risk?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21797.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21797.ps1
new file mode 100644
index 000000000000..b35dd6b651c5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21797.ps1
@@ -0,0 +1,150 @@
+function Invoke-CippTestZTNA21797 {
+    <#
+    .SYNOPSIS
+    Restrict access to high risk users
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $allCAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+        $authMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $allCAPolicies -or -not $authMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21797' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Restrict access to high risk users' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+            return
+        }
+
+        $caPasswordChangePolicies = $allCAPolicies | Where-Object {
+            $_.conditions.userRiskLevels -contains 'high' -and
+            $_.grantControls.builtInControls -contains 'passwordChange' -and
+            $_.state -eq 'enabled'
+        }
+
+        $caBlockPolicies = $allCAPolicies | Where-Object {
+            $_.conditions.userRiskLevels -contains 'high' -and
+            $_.grantControls.builtInControls -contains 'block' -and
+            $_.state -eq 'enabled'
+        }
+
+        $inactiveCAPolicies = $allCAPolicies | Where-Object {
+            $_.conditions.userRiskLevels -contains 'high' -and
+            ($_.grantControls.builtInControls -contains 'passwordChange' -or $_.grantControls.builtInControls -contains 'block') -and
+            $_.state -ne 'enabled'
+        }
+
+        $passwordlessEnabled = $false
+        $passwordlessAuthMethods = @()
+
+        if ($authMethodsPolicy.authenticationMethodConfigurations) {
+            foreach ($method in $authMethodsPolicy.authenticationMethodConfigurations) {
+                $isPasswordless = $false
+                $methodName = $method.id
+                $methodState = $method.state
+                $additionalInfo = ''
+
+                if ($method.id -in @('fido2')) {
+                    $isPasswordless = ($method.state -eq 'enabled')
+                }
+
+                if ($method.id -eq 'x509Certificate') {
+                    if ($method.state -eq 'enabled' -and $method.x509CertificateAuthenticationDefaultMode -eq 'x509CertificateMultiFactor') {
+                        $isPasswordless = $true
+                        $additionalInfo = ' (Mode: x509CertificateMultiFactor)'
+                    }
+                }
+
+                if ($isPasswordless) {
+                    $passwordlessEnabled = $true
+                    $passwordlessAuthMethods += [PSCustomObject]@{
+                        Name           = $methodName
+                        State          = $methodState
+                        AdditionalInfo = $additionalInfo
+                    }
+                }
+            }
+        }
+
+        $result = $false
+        if ((-not $passwordlessEnabled -and ($caPasswordChangePolicies.Count + $caBlockPolicies.Count -gt 0)) -or
+            ($passwordlessEnabled -and $caBlockPolicies.Count -gt 0)) {
+            $result = $true
+        }
+
+        $testResultMarkdown = ''
+
+        if ($result) {
+            $testResultMarkdown = 'Policies to restrict access for high risk users are properly implemented.'
+        } else {
+            if ($passwordlessEnabled -and $caBlockPolicies.Count -eq 0) {
+                $testResultMarkdown = 'Passwordless authentication is enabled, but no policies to block high risk users are configured.'
+            } else {
+                $testResultMarkdown = 'No policies found to protect against high risk users.'
+            }
+        }
+
+        $mdInfo = "`n## Passwordless Authentication Methods allowed in tenant`n`n"
+
+        if ($passwordlessAuthMethods.Count -gt 0) {
+            $mdInfo += "| Authentication Method Name | State | Additional Info |`n"
+            $mdInfo += "| :------------------------ | :---- | :-------------- |`n"
+            foreach ($method in $passwordlessAuthMethods) {
+                $mdInfo += "| $($method.Name) | $($method.State) | $($method.AdditionalInfo) |`n"
+            }
+        } else {
+            $mdInfo += "No passwordless authentication methods are enabled.`n"
+        }
+
+        $mdInfo += "`n## Conditional Access Policies targeting high risk users`n`n"
+
+        $allEnabledHighRiskPolicies = @($caPasswordChangePolicies) + @($caBlockPolicies)
+
+        if ($allEnabledHighRiskPolicies.Count -gt 0) {
+            $mdInfo += "| Conditional Access Policy Name | Status | Conditions |`n"
+            $mdInfo += "| :--------------------- | :----- | :--------- |`n"
+
+            foreach ($policy in $allEnabledHighRiskPolicies) {
+                $conditions = 'User Risk Level: High'
+                if ($policy.grantControls.builtInControls -contains 'passwordChange') {
+                    $conditions += ', Control: Password Change'
+                }
+                if ($policy.grantControls.builtInControls -contains 'block') {
+                    $conditions += ', Control: Block'
+                }
+                $mdInfo += "| $($policy.displayName) | Enabled | $conditions |`n"
+            }
+        }
+
+        if ($inactiveCAPolicies.Count -gt 0) {
+            if ($allEnabledHighRiskPolicies.Count -eq 0) {
+                $mdInfo += "No conditional access policies targeting high risk users found.`n`n"
+                $mdInfo += "### Inactive policies targeting high risk users (not contributing to security posture):`n`n"
+                $mdInfo += "| Conditional Access Policy Name | Status | Conditions |`n"
+                $mdInfo += "| :--------------------- | :----- | :--------- |`n"
+            }
+
+            foreach ($policy in $inactiveCAPolicies) {
+                $conditions = 'User Risk Level: High'
+                if ($policy.grantControls.builtInControls -contains 'passwordChange') {
+                    $conditions += ', Control: Password Change'
+                }
+                if ($policy.grantControls.builtInControls -contains 'block') {
+                    $conditions += ', Control: Block'
+                }
+                $status = if ($policy.state -eq 'enabledForReportingButNotEnforced') { 'Report-only' } else { 'Disabled' }
+                $mdInfo += "| $($policy.displayName) | $status | $conditions |`n"
+            }
+        } elseif ($allEnabledHighRiskPolicies.Count -eq 0) {
+            $mdInfo += "No conditional access policies targeting high risk users found.`n"
+        }
+
+        $testResultMarkdown = $testResultMarkdown + $mdInfo
+
+        $Status = if ($result) { 'Passed' } else { 'Failed' }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21797' -TestType 'Identity' -Status $Status -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Restrict access to high risk users' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21797' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Restrict access to high risk users' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21798.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21798.md
new file mode 100644
index 000000000000..3c34e31de3ed
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21798.md
@@ -0,0 +1,8 @@
+If you don't enable ID Protection notifications, your organization loses critical real-time alerts when threat actors compromise user accounts or conduct reconnaissance activities. When Microsoft Entra ID Protection detects accounts at risk, it sends email alerts with **Users at risk detected** as the subject and links to the **Users flagged for risk** report. Without these notifications, security teams remain unaware of active threats, allowing threat actors to maintain persistence in compromised accounts without being detected. You can feed these risks into tools like Conditional Access to make access decisions or send them to a security information and event management (SIEM) tool for investigation and correlation. Threat actors can use this detection gap to conduct lateral movement activities, privilege escalation attempts, or data exfiltration operations while administrators remain unaware of the ongoing compromise. The delayed response enables threat actors to establish more persistence mechanisms, change user permissions, or access sensitive resources before you can fix the issue. Without proactive notification of risk detections, organizations must rely solely on manual monitoring of risk reports, which significantly increases the time it takes to detect and respond to identity-based attacks.   
+
+**Remediation action**
+
+- [Configure users at risk detected alerts](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-notifications?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-users-at-risk-detected-alerts)  
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21799.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21799.md
new file mode 100644
index 000000000000..68af01ead6db
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21799.md
@@ -0,0 +1,8 @@
+When high-risk sign-ins are not properly restricted through Conditional Access policies, organizations expose themselves to security vulnerabilities. Threat actors can exploit these gaps for initial access through compromised credentials, credential stuffing attacks, or anomalous sign-in patterns that Microsoft Entra ID Protection identifies as risky behaviors. Without appropriate restrictions, threat actors who successfully authenticate during high-risk scenarios can perform privilege escalation by misusing the authenticated session to access sensitive resources, modify security configurations, or conduct reconnaissance activities within the environment. Once threat actors establish access through uncontrolled high-risk sign-ins, they can achieve persistence by creating additional accounts, installing backdoors, or modifying authentication policies to maintain long-term access to the organization's resources. The unrestricted access enables threat actors to conduct lateral movement across systems and applications using the authenticated session, potentially accessing sensitive data stores, administrative interfaces, or critical business applications. Finally, threat actors achieve impact through data exfiltration, or compromise business-critical systems while maintaining plausible deniability by exploiting the fact that their risky authentication was not properly challenged or blocked.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to require MFA for elevated sign-in risk](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-risk-based-sign-in?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21799.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21799.ps1
new file mode 100644
index 000000000000..0fd5396bd764
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21799.ps1
@@ -0,0 +1,83 @@
+function Invoke-CippTestZTNA21799 {
+    <#
+    .SYNOPSIS
+    Restrict high risk sign-ins
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $authMethodPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+        $allCAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $allCAPolicies -or -not $authMethodPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21799' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Restrict high risk sign-ins' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+            return
+        }
+
+        $matchedPolicies = $null
+
+        if (($authMethodPolicy.authenticationMethodConfigurations.state -eq 'enabled').count -gt 0) {
+            $matchedPolicies = $allCAPolicies | Where-Object {
+                $_.conditions.signInRiskLevels -eq 'high' -and
+                ($_.conditions.users.includeUsers -contains 'All') -and
+                ($_.grantControls.builtInControls -contains 'block' -or $_.grantControls.builtInControls -contains 'mfa' -or $null -ne $_.grantControls.authenticationStrength) -and
+                ($_.state -eq 'enabled')
+            }
+        } else {
+            $matchedPolicies = $allCAPolicies | Where-Object {
+                $_.conditions.signInRiskLevels -eq 'high' -and
+                ($_.conditions.users.includeUsers -contains 'All') -and
+                ($_.grantControls.builtInControls -contains 'block') -and
+                ($_.state -eq 'enabled')
+            }
+        }
+
+        $testResultMarkdown = ''
+
+        if ($matchedPolicies.Count -gt 0) {
+            $passed = 'Passed'
+            $testResultMarkdown = 'All high-risk sign-in attempts are mitigated by Conditional Access policies enforcing appropriate controls.'
+        } else {
+            $passed = 'Failed'
+            $testResultMarkdown = 'Some high-risk sign-in attempts are not adequately mitigated by Conditional Access policies.'
+        }
+
+        $reportTitle = 'Conditional Access Policies targeting high-risk sign-in attempts'
+        $tableRows = ''
+
+        if ($matchedPolicies.Count -gt 0) {
+            $mdInfo = "`n## $reportTitle`n`n"
+            $mdInfo += "| Policy Name | Grant Controls | Target Users |`n"
+            $mdInfo += "| :---------- | :------------- | :----------- |`n"
+
+            foreach ($policy in $matchedPolicies) {
+                $grantControls = switch ($policy.grantControls) {
+                    { $_.builtInControls -contains 'block' } {
+                        'Block Access'
+                    }
+                    { $_.builtInControls -contains 'mfa' } {
+                        'Require Multi-Factor Authentication'
+                    }
+                    { $null -ne $_.authenticationStrength } {
+                        'Require Authentication Strength'
+                    }
+                }
+
+                $targetUsers = if ($policy.conditions.users.includeUsers -contains 'All') {
+                    'All Users'
+                } else {
+                    $policy.conditions.users.includeUsers -join ', '
+                }
+
+                $mdInfo += "| $($policy.displayName) | $grantControls | $targetUsers |`n"
+            }
+        }
+        $testResultMarkdown = $testResultMarkdown + $mdInfo
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21799' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Block high risk sign-ins' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21799' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Restrict high risk sign-ins' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21800.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21800.md
new file mode 100644
index 000000000000..a010c4484edc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21800.md
@@ -0,0 +1,13 @@
+Attackers might gain access if multifactor authentication (MFA) isn't universally enforced or if there are exceptions in place. Attackers might gain access by exploiting vulnerabilities of weaker MFA methods like SMS and phone calls through social engineering techniques. These techniques might include SIM swapping or phishing, to intercept authentication codes.
+
+Attackers might use these accounts as entry points into the tenant. By using intercepted user sessions, attackers can disguise their activities as legitimate user actions, evade detection, and continue their attack without raising suspicion. From there, they might attempt to manipulate MFA settings to establish persistence, plan, and execute further attacks based on the privileges of compromised accounts.
+
+**Remediation action**
+
+- [Deploy multifactor authentication](https://learn.microsoft.com/entra/identity/authentication/howto-mfa-getstarted?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Get started with a phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Deploy a Conditional Access policy to require phishing-resistant MFA for all users](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Review authentication methods activity](https://learn.microsoft.com/entra/identity/monitoring-health/concept-usage-insights-report?tabs=microsoft-entra-admin-center&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-methods-activity)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21801.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21801.md
new file mode 100644
index 000000000000..a010c4484edc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21801.md
@@ -0,0 +1,13 @@
+Attackers might gain access if multifactor authentication (MFA) isn't universally enforced or if there are exceptions in place. Attackers might gain access by exploiting vulnerabilities of weaker MFA methods like SMS and phone calls through social engineering techniques. These techniques might include SIM swapping or phishing, to intercept authentication codes.
+
+Attackers might use these accounts as entry points into the tenant. By using intercepted user sessions, attackers can disguise their activities as legitimate user actions, evade detection, and continue their attack without raising suspicion. From there, they might attempt to manipulate MFA settings to establish persistence, plan, and execute further attacks based on the privileges of compromised accounts.
+
+**Remediation action**
+
+- [Deploy multifactor authentication](https://learn.microsoft.com/entra/identity/authentication/howto-mfa-getstarted?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Get started with a phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Deploy a Conditional Access policy to require phishing-resistant MFA for all users](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Review authentication methods activity](https://learn.microsoft.com/entra/identity/monitoring-health/concept-usage-insights-report?tabs=microsoft-entra-admin-center&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-methods-activity)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21801.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21801.ps1
new file mode 100644
index 000000000000..1b3783d09304
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21801.ps1
@@ -0,0 +1,95 @@
+function Invoke-CippTestZTNA21801 {
+    <#
+    .SYNOPSIS
+    Users have strong authentication methods configured
+    #>
+    param($Tenant)
+
+    try {
+        $UserRegistrationDetails = New-CIPPDbRequest -TenantFilter $Tenant -Type 'UserRegistrationDetails'
+        $Users = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users'
+
+        if (-not $UserRegistrationDetails -or -not $Users) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21801' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Users have strong authentication methods configured' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Credential Management'
+            return
+        }
+
+        $PhishResistantMethods = @('passKeyDeviceBound', 'passKeyDeviceBoundAuthenticator', 'windowsHelloForBusiness')
+
+        $results = $UserRegistrationDetails | Where-Object {
+            $userId = $_.id
+            $matchingUser = $Users | Where-Object { $_.id -eq $userId -and $_.accountEnabled }
+            $matchingUser
+        } | ForEach-Object {
+            $regDetail = $_
+            $matchingUser = $Users | Where-Object { $_.id -eq $regDetail.id }
+            $hasPhishResistant = $false
+
+            if ($regDetail.methodsRegistered) {
+                foreach ($method in $PhishResistantMethods) {
+                    if ($regDetail.methodsRegistered -contains $method) {
+                        $hasPhishResistant = $true
+                        break
+                    }
+                }
+            }
+
+            [PSCustomObject]@{
+                id                           = $regDetail.id
+                displayName                  = $regDetail.userDisplayName
+                phishResistantAuthMethod     = $hasPhishResistant
+                lastSuccessfulSignInDateTime = $matchingUser.signInActivity.lastSuccessfulSignInDateTime
+            }
+        }
+
+        $totalUserCount = $results.Length
+        $phishResistantUsers = $results | Where-Object { $_.phishResistantAuthMethod }
+        $phishableUsers = $results | Where-Object { !$_.phishResistantAuthMethod }
+
+        $phishResistantUserCount = $phishResistantUsers.Length
+
+        $passed = $totalUserCount -eq $phishResistantUserCount
+
+        $testResultMarkdown = if ($passed) {
+            "Validated that all users have registered phishing resistant authentication methods.`n`n%TestResult%"
+        } else {
+            "Found users that have not yet registered phishing resistant authentication methods`n`n%TestResult%"
+        }
+
+        $mdInfo = "## Users strong authentication methods`n`n"
+
+        if ($passed) {
+            $mdInfo = "All users have registered phishing resistant authentication methods.`n`n"
+        } else {
+            $mdInfo = "Found users that have not registered phishing resistant authentication methods.`n`n"
+        }
+
+        $mdInfo = $mdInfo + "| User | Last sign in | Phishing resistant method registered |`n"
+        $mdInfo = $mdInfo + "| :--- | :--- | :---: |`n"
+
+        $userLinkFormat = 'https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/UserAuthMethods/userId/{0}/hidePreviewBanner~/true'
+
+        $mdLines = @($phishableUsers | Sort-Object displayName | ForEach-Object {
+                $userLink = $userLinkFormat -f $_.id
+                $lastSignInDate = if ($_.lastSuccessfulSignInDateTime) { (Get-Date $_.lastSuccessfulSignInDateTime -Format 'yyyy-MM-dd') } else { 'Never' }
+                "|[$($_.displayName)]($userLink)| $lastSignInDate | ❌ |`n"
+            })
+        $mdInfo = $mdInfo + ($mdLines -join '')
+
+        $mdLines = @($phishResistantUsers | Sort-Object displayName | ForEach-Object {
+                $userLink = $userLinkFormat -f $_.id
+                $lastSignInDate = if ($_.lastSuccessfulSignInDateTime) { (Get-Date $_.lastSuccessfulSignInDateTime -Format 'yyyy-MM-dd') } else { 'Never' }
+                "|[$($_.displayName)]($userLink)| $lastSignInDate | ✅ |`n"
+            })
+        $mdInfo = $mdInfo + ($mdLines -join '')
+
+        $testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21801' -TestType 'Identity' -Status $(if ($passed) { 'Passed' } else { 'Failed' }) -ResultMarkdown $testResultMarkdown -Risk 'Medium' -Name 'Users have strong authentication methods configured' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Credential Management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21801' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Users have strong authentication methods configured' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Credential Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21802.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21802.md
new file mode 100644
index 000000000000..61cf321650cd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21802.md
@@ -0,0 +1,8 @@
+Without sign-in context, threat actors can exploit authentication fatigue by flooding users with push notifications, increasing the chance that a user accidentally approves a malicious request. When users get generic push notifications without the application name or geographic location, they don't have the information they need to make informed approval decisions. This lack of context makes users vulnerable to social engineering attacks, especially when threat actors time their requests during periods of legitimate user activity. This vulnerability is especially dangerous when threat actors gain initial access through credential harvesting or password spraying attacks and then try to establish persistence by approving multifactor authentication (MFA) requests from unexpected applications or locations. Without contextual information, users can't detect unusual sign-in attempts, allowing threat actors to maintain access and escalate privileges by moving laterally through systems after bypassing the initial authentication barrier. Without application and location context, security teams also lose valuable telemetry for detecting suspicious authentication patterns that can indicate ongoing compromise or reconnaissance activities.   
+
+**Remediation action**
+Give users the context they need to make informed approval decisions. Configure Microsoft Authenticator notifications by setting the Authentication methods policy to include the application name and geographic location.  
+- [Use additional context in Authenticator notifications - Authentication methods policy](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-additional-context?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21802.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21802.ps1
new file mode 100644
index 000000000000..24956ef8276c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21802.ps1
@@ -0,0 +1,40 @@
+function Invoke-CippTestZTNA21802 {
+    <#
+    .SYNOPSIS
+    Microsoft Authenticator app shows sign-in context
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21802' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Microsoft Authenticator app shows sign-in context' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access Control'
+            return
+        }
+
+        $AuthenticatorConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'MicrosoftAuthenticator' }
+
+        if (-not $AuthenticatorConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21802' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'Microsoft Authenticator configuration not found in authentication methods policy' -Risk 'Medium' -Name 'Microsoft Authenticator app shows sign-in context' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access Control'
+            return
+        }
+
+        $AppInfoEnabled = $AuthenticatorConfig.featureSettings.displayAppInformationRequiredState.state -eq 'enabled'
+        $LocationInfoEnabled = $AuthenticatorConfig.featureSettings.displayLocationInformationRequiredState.state -eq 'enabled'
+
+        if ($AppInfoEnabled -and $LocationInfoEnabled) {
+            $Status = 'Passed'
+            $Result = 'Microsoft Authenticator shows application name and geographic location in push notifications'
+        } else {
+            $Status = 'Failed'
+            $Result = "Microsoft Authenticator sign-in context incomplete - App info: $AppInfoEnabled, Location info: $LocationInfoEnabled"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21802' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Microsoft Authenticator app shows sign-in context' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access Control'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21802' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Microsoft Authenticator app shows sign-in context' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access Control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21803.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21803.md
new file mode 100644
index 000000000000..6f99cf455fac
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21803.md
@@ -0,0 +1,13 @@
+Legacy multifactor authentication (MFA) and self-service password reset (SSPR) policies in Microsoft Entra ID manage authentication methods separately, leading to fragmented configurations and suboptimal user experience. Moreover, managing these policies independently increases administrative overhead and the risk of misconfiguration.  
+
+Migrating to the combined Authentication Methods policy consolidates the management of MFA, SSPR, and passwordless authentication methods into a single policy framework. This unification allows for more granular control, enabling administrators to target specific authentication methods to user groups and enforce consistent security measures across the organization. Additionally, the unified policy supports modern authentication methods, such as FIDO2 security keys and Windows Hello for Business, enhancing the organization's security posture.
+
+Microsoft announced the deprecation of legacy MFA and SSPR policies, with a retirement date set for September 30, 2025. Organizations are advised to complete the migration to the Authentication Methods policy before this date to avoid potential disruptions and to benefit from the enhanced security and management capabilities of the unified policy.
+
+**Remediation action**
+
+- [Enable combined security information registration](https://learn.microsoft.com/entra/identity/authentication/howto-registration-mfa-sspr-combined?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [How to migrate MFA and SSPR policy settings to the Authentication methods policy for Microsoft Entra ID](https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-methods-manage?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21803.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21803.ps1
new file mode 100644
index 000000000000..38cfc0f542a8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21803.ps1
@@ -0,0 +1,35 @@
+function Invoke-CippTestZTNA21803 {
+    <#
+    .SYNOPSIS
+    Migrate from legacy MFA and SSPR policies
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21803' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Migrate from legacy MFA and SSPR policies' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Credential Management'
+            return
+        }
+
+        $PolicyMigrationState = $AuthMethodsPolicy.policyMigrationState
+
+        if ($PolicyMigrationState -eq 'migrationComplete') {
+            $Status = 'Passed'
+            $Result = 'Tenant has migrated from legacy MFA and SSPR policies to authentication methods policy'
+        } elseif ($PolicyMigrationState -eq 'migrationInProgress') {
+            $Status = 'Investigate'
+            $Result = 'Tenant migration from legacy MFA and SSPR policies is in progress'
+        } else {
+            $Status = 'Failed'
+            $Result = "Tenant has not migrated from legacy MFA and SSPR policies (state: $PolicyMigrationState)"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21803' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Migrate from legacy MFA and SSPR policies' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Credential Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21803' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Migrate from legacy MFA and SSPR policies' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Credential Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21804.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21804.md
new file mode 100644
index 000000000000..c4a3d5bd3265
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21804.md
@@ -0,0 +1,12 @@
+When weak authentication methods like SMS and voice calls remain enabled in Microsoft Entra ID, threat actors can exploit these vulnerabilities through multiple attack vectors. Initially, attackers often conduct reconnaissance to identify organizations using these weaker authentication methods through social engineering or technical scanning. Then they can execute initial access through credential stuffing attacks, password spraying, or phishing campaigns targeting user credentials.
+
+Once basic credentials are compromised, threat actors use these weaknesses in SMS and voice-based authentication. SMS messages can be intercepted through SIM swapping attacks, SS7 network vulnerabilities, or malware on mobile devices, while voice calls are susceptible to voice phishing (vishing) and call forwarding manipulation. With these weak second factors bypassed, attackers achieve persistence by registering their own authentication methods. Compromised accounts can be used to target higher-privileged users through internal phishing or social engineering, allowing attackers to escalate privileges within the organization. Finally, threat actors achieve their objectives through data exfiltration, lateral movement to critical systems, or deployment of other malicious tools, all while maintaining stealth by using legitimate authentication pathways that appear normal in security logs. 
+
+**Remediation action**
+
+- [Deploy authentication method registration campaigns to encourage stronger methods](https://learn.microsoft.com/graph/api/authenticationmethodspolicy-update?view=graph-rest-beta&preserve-view=true&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Disable authentication methods](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Disable phone-based methods in legacy MFA settings](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-mfasettings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Deploy Conditional Access policies using authentication strength](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strength-how-it-works?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21804.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21804.ps1
new file mode 100644
index 000000000000..9882b9e0713c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21804.ps1
@@ -0,0 +1,46 @@
+function Invoke-CippTestZTNA21804 {
+    <#
+    .SYNOPSIS
+    SMS and Voice Call authentication methods are disabled
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $authMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $authMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21804' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'SMS and Voice Call authentication methods are disabled' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Credential Management'
+            return
+        }
+
+        $matchedMethods = $authMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Sms' -or $_.id -eq 'Voice' }
+
+        $testResultMarkdown = ''
+
+        if ($matchedMethods.state -contains 'enabled') {
+            $passed = 'Failed'
+            $testResultMarkdown = 'Found weak authentication methods that are still enabled.'
+        } else {
+            $passed = 'Passed'
+            $testResultMarkdown = 'SMS and voice calls authentication methods are disabled in the tenant.'
+        }
+
+        $reportTitle = 'Weak authentication methods'
+
+        $mdInfo = "`n## $reportTitle`n`n"
+        $mdInfo += "| Method ID | Is method weak? | State |`n"
+        $mdInfo += "| :-------- | :-------------- | :---- |`n"
+
+        foreach ($method in $matchedMethods) {
+            $mdInfo += "| $($method.id) | Yes | $($method.state) |`n"
+        }
+
+        $testResultMarkdown = $testResultMarkdown + $mdInfo
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21804' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Weak authentication methods are disabled' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21804' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'SMS and Voice Call authentication methods are disabled' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Credential Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21806.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21806.md
new file mode 100644
index 000000000000..f0b3ce89d4e6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21806.md
@@ -0,0 +1,10 @@
+Without Conditional Access policies protecting security information registration, threat actors can exploit unprotected registration flows to compromise authentication methods. When users register multifactor authentication and self-service password reset methods without proper controls, threat actors can intercept these registration sessions through adversary-in-the-middle attacks or exploit unmanaged devices accessing registration from untrusted locations. Once threat actors gain access to an unprotected registration flow, they can register their own authentication methods, effectively hijacking the target's authentication profile. The threat actors can bypass security controls and potentially escalate privileges throughout the environment because they can maintain persistent access by controlling the MFA methods. The compromised authentication methods then become the foundation for lateral movement as threat actors can authenticate as the legitimate user across multiple services and applications.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy for security info registration](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-security-info-registration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Configure known network locations](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Enable combined security info registration](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-registration-mfa-sspr-combined?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21806.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21806.ps1
new file mode 100644
index 000000000000..6a7864fb17c8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21806.ps1
@@ -0,0 +1,55 @@
+function Invoke-CippTestZTNA21806 {
+    <#
+    .SYNOPSIS
+    Secure the MFA registration (My Security Info) page
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $allCAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $allCAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21806' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Secure the MFA registration (My Security Info) page' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+            return
+        }
+
+        $matchedPolicies = $allCAPolicies | Where-Object {
+            ($_.conditions.applications.includeUserActions -contains 'urn:user:registersecurityinfo') -and
+            ($_.conditions.users.includeUsers -contains 'All') -and
+            $_.state -eq 'enabled'
+        }
+
+        $testResultMarkdown = ''
+
+        if ($matchedPolicies.Count -gt 0) {
+            $passed = 'Passed'
+            $testResultMarkdown = 'Security information registration is protected by Conditional Access policies.'
+        } else {
+            $passed = 'Failed'
+            $testResultMarkdown = 'Security information registration is not protected by Conditional Access policies.'
+        }
+
+        $reportTitle = 'Conditional Access Policies targeting security information registration'
+        $tableRows = ''
+
+        if ($matchedPolicies.Count -gt 0) {
+            $mdInfo = "`n## $reportTitle`n`n"
+            $mdInfo += "| Policy Name | User Actions Targeted | Grant Controls Applied |`n"
+            $mdInfo += "| :---------- | :-------------------- | :--------------------- |`n"
+
+            foreach ($policy in $matchedPolicies) {
+                $mdInfo += "| $($policy.displayName) | $($policy.conditions.applications.includeUserActions) | $($policy.grantControls.builtInControls -join ', ') |`n"
+            }
+        } else {
+            $mdInfo = 'No Conditional Access policies targeting security information registration.'
+        }
+
+        $testResultMarkdown = $testResultMarkdown + $mdInfo
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21806' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Secure the MFA registration (My Security Info) page' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21806' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Secure the MFA registration (My Security Info) page' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Conditional Access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21807.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21807.md
new file mode 100644
index 000000000000..f20e5690891a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21807.md
@@ -0,0 +1,12 @@
+If nonprivileged users can create applications and service principals, these accounts might be misconfigured or be granted more permissions than necessary, creating new vectors for attackers to gain initial access. Attackers can exploit these accounts to establish valid credentials in the environment and bypass some security controls.
+
+If these nonprivileged accounts are mistakenly granted elevated application owner permissions, attackers can use them to move from a lower level of access to a more privileged level of access. Attackers who compromise nonprivileged accounts might add their own credentials or change the permissions associated with the applications created by the nonprivileged users to ensure they can continue to access the environment undetected.
+
+Attackers can use service principals to blend in with legitimate system processes and activities. Because service principals often perform automated tasks, malicious activities carried out under these accounts might not be flagged as suspicious.
+
+**Remediation action**
+
+- [Block nonprivileged users from creating apps](https://learn.microsoft.com/entra/identity/role-based-access-control/delegate-app-roles?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21807.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21807.ps1
new file mode 100644
index 000000000000..2e5f195f5c94
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21807.ps1
@@ -0,0 +1,32 @@
+function Invoke-CippTestZTNA21807 {
+    <#
+    .SYNOPSIS
+    Creating new applications and service principals is restricted to privileged users
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $AuthPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21807' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Creating new applications and service principals is restricted to privileged users' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+            return
+        }
+
+        $CanCreateApps = $AuthPolicy.defaultUserRolePermissions.allowedToCreateApps
+
+        if ($CanCreateApps -eq $false) {
+            $Status = 'Passed'
+            $Result = 'Tenant is configured to prevent users from registering applications'
+        } else {
+            $Status = 'Failed'
+            $Result = 'Tenant allows all non-privileged users to register applications'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21807' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Creating new applications and service principals is restricted to privileged users' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21807' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Creating new applications and service principals is restricted to privileged users' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21808.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21808.md
new file mode 100644
index 000000000000..de6e6b429a7d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21808.md
@@ -0,0 +1,8 @@
+Device code flow is a cross-device authentication flow designed for input-constrained devices. It can be exploited in phishing attacks, where an attacker initiates the flow and tricks a user into completing it on their device, thereby sending the user's tokens to the attacker. Given the security risks and the infrequent legitimate use of device code flow, you should enable a Conditional Access policy to block this flow by default.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to block device code flow](https://learn.microsoft.com/entra/identity/conditional-access/policy-block-authentication-flows?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#device-code-flow-policies).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21808.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21808.ps1
new file mode 100644
index 000000000000..289ae9e1f36d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21808.ps1
@@ -0,0 +1,45 @@
+function Invoke-CippTestZTNA21808 {
+    <#
+    .SYNOPSIS
+    Restrict device code flow
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+        if (-not $CAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21808' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Restrict device code flow' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access Control'
+            return
+        }
+
+        $Enabled = $CAPolicies | Where-Object { $_.state -eq 'enabled' }
+        $DeviceCodePolicies = $Enabled | Where-Object {
+            if ($_.conditions.authenticationFlows.transferMethods) {
+                $Methods = $_.conditions.authenticationFlows.transferMethods -split ','
+                $Methods -contains 'deviceCodeFlow'
+            } else {
+                $false
+            }
+        }
+
+        $BlockPolicies = $DeviceCodePolicies | Where-Object { $_.grantControls.builtInControls -contains 'block' }
+
+        if ($BlockPolicies.Count -gt 0) {
+            $Status = 'Passed'
+            $Result = "Device code flow is properly restricted with $($BlockPolicies.Count) blocking policy/policies"
+        } elseif ($DeviceCodePolicies.Count -eq 0) {
+            $Status = 'Failed'
+            $Result = 'No Conditional Access policies found targeting device code flow'
+            #Add table with existing policies?
+        } else {
+            $Status = 'Failed'
+            $Result = 'Device code flow policies exist but none are configured to block'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21808' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Restrict device code flow' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access Control'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21808' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Restrict device code flow' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access Control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21809.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21809.md
new file mode 100644
index 000000000000..3689a7af5877
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21809.md
@@ -0,0 +1,11 @@
+Enabling the Admin consent workflow in a Microsoft Entra tenant is a vital security measure that mitigates risks associated with unauthorized application access and privilege escalation. This check is important because it ensures that any application requesting elevated permission undergoes a review process by designated administrators before consent is granted. The admin consent workflow in Microsoft Entra ID notifies reviewers who evaluate and approve or deny consent requests based on the application's legitimacy and necessity. If this check doesn't pass, meaning the workflow is disabled, any application can request and potentially receive elevated permissions without administrative review. This poses a substantial security risk, as malicious actors could exploit this lack of oversight to gain unauthorized access to sensitive data, perform privilege escalation, or execute other malicious activities.
+
+**Remediation action**
+
+For admin consent requests, set the **Users can request admin consent to apps they are unable to consent to** setting to **Yes**. Specify other settings, such as who can review requests.
+
+- [Enable the admin consent workflow](https://learn.microsoft.com/entra/identity/enterprise-apps/configure-admin-consent-workflow?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-the-admin-consent-workflow)
+- Or use the [Update adminConsentRequestPolicy](https://learn.microsoft.com/graph/api/adminconsentrequestpolicy-update?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) API to set the `isEnabled` property to true and other settings
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21809.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21809.ps1
new file mode 100644
index 000000000000..f3422476b53c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21809.ps1
@@ -0,0 +1,30 @@
+function Invoke-CippTestZTNA21809 {
+    <#
+    .SYNOPSIS
+    Admin consent workflow is enabled
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $result = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AdminConsentRequestPolicy'
+
+        if (-not $result) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21809' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Admin consent workflow is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+            return
+        }
+
+        $passed = if ($result.isEnabled) { 'Passed' } else { 'Failed' }
+
+        if ($result.isEnabled) {
+            $testResultMarkdown = 'Admin consent workflow is enabled.'
+        } else {
+            $testResultMarkdown = "Admin consent workflow is disabled.`n`nThe adminConsentRequestPolicy.isEnabled property is set to false."
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21809' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Admin consent workflow is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21809' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Admin consent workflow is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21810.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21810.md
new file mode 100644
index 000000000000..2ac799e81e92
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21810.md
@@ -0,0 +1,8 @@
+Letting group owners consent to applications in Microsoft Entra ID creates a lateral escalation path that lets threat actors persist and steal data without admin credentials. If an attacker compromises a group owner account, they can register or use a malicious application and consent to high-privilege Graph API permissions scoped to the group. Attackers can potentially read all Teams messages, access SharePoint files, or manage group membership. This consent action creates a long-lived application identity with delegated or application permissions. The attacker maintains persistence with OAuth tokens, steals sensitive data from team channels and files, and impersonates users through messaging or email permissions. Without centralized enforcement of app consent policies, security teams lose visibility, and malicious applications spread under the radar, enabling multi-stage attacks across collaboration platforms.
+
+**Remediation action**
+Configure preapproval of Resource-Specific Consent (RSC) permissions.
+- [Preapproval of RSC permissions](https://learn.microsoft.com/microsoftteams/platform/graph-api/rsc/preapproval-instruction-docs?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21810.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21810.ps1
new file mode 100644
index 000000000000..3f7d1d03f123
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21810.ps1
@@ -0,0 +1,39 @@
+function Invoke-CippTestZTNA21810 {
+    <#
+    .SYNOPSIS
+    Resource-specific consent is restricted
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $authPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $authPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21810' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Resource-specific consent is restricted' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application Management'
+            return
+        }
+
+        $teamPermission = 'managepermissiongrantsforownedresource.microsoft-dynamically-managed-permissions-for-team'
+        $hasTeamPermission = $authPolicy.permissionGrantPolicyIdsAssignedToDefaultUserRole -contains $teamPermission
+
+        if (-not $hasTeamPermission) {
+            $state = 'DisabledForAllApps'
+        } else {
+            $state = 'EnabledForAllApps'
+        }
+
+        if ($state -eq 'DisabledForAllApps') {
+            $passed = 'Passed'
+            $testResultMarkdown = "Resource-Specific Consent is restricted.`n`nThe current state is $state."
+        } else {
+            $passed = 'Failed'
+            $testResultMarkdown = "Resource-Specific Consent is not restricted.`n`nThe current state is $state."
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21810' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'Medium' -Name 'Resource-specific consent is restricted' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21810' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Resource-specific consent is restricted' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21811.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21811.md
new file mode 100644
index 000000000000..fc521a90eb64
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21811.md
@@ -0,0 +1,17 @@
+When password expiration policies remain enabled, threat actors can exploit the predictable password rotation patterns that users typically follow when forced to change passwords regularly. Users frequently create weaker passwords by making minimal modifications to existing ones, such as incrementing numbers or adding sequential characters. Threat actors can easily anticipate and exploit these types of changes through credential stuffing attacks or targeted password spraying campaigns. These predictable patterns enable threat actors to establish persistence through:
+
+- Compromised credentials
+- Escalated privileges by targeting administrative accounts with weak rotated passwords
+- Maintaining long-term access by predicting future password variations
+
+Research shows that users create weaker, more predictable passwords when they are forced to expire. These predictable passwords are easier for experienced attackers to crack, as they often make simple modifications to existing passwords rather than creating entirely new, strong passwords. Additionally, when users are required to frequently change passwords, they might resort to insecure practices such as writing down passwords or storing them in easily accessible locations, creating more attack vectors for threat actors to exploit during physical reconnaissance or social engineering campaigns. 
+
+**Remediation action**
+
+- [Set the password expiration policy for your organization](https://learn.microsoft.com/microsoft-365/admin/manage/set-password-expiration-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+    - Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com/). Go to **Settings** > **Org Settings** >** Security & Privacy** > **Password expiration policy**. Ensure the **Set passwords to never expire** setting is checked.
+- [Disable password expiration using Microsoft Graph](https://learn.microsoft.com/graph/api/domain-update?view=graph-rest-1.0&preserve-view=true&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+- [Set individual user passwords to never expire using Microsoft Graph PowerShell](https://learn.microsoft.com/microsoft-365/admin/add-users/set-password-to-never-expire?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+    - `Update-MgUser -UserId <UserID> -PasswordPolicies DisablePasswordExpiration`<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21811.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21811.ps1
new file mode 100644
index 000000000000..6315dc929433
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21811.ps1
@@ -0,0 +1,81 @@
+function Invoke-CippTestZTNA21811 {
+    <#
+    .SYNOPSIS
+    Password expiration is disabled
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $domains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Domains'
+
+        if (-not $domains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21811' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Password expiration is disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential Management'
+            return
+        }
+
+        $misconfiguredDomains = $domains | Where-Object { $_.passwordValidityPeriodInDays -ne 2147483647 }
+
+        $users = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users'
+
+        $misconfiguredUsers = @()
+        if ($users) {
+            $misconfiguredUsers = foreach ($user in $users) {
+                $userDomain = $user.userPrincipalName.Split('@')[-1]
+                $domainPolicy = $misconfiguredDomains | Where-Object { $_.id -eq $userDomain }
+                if (($user.passwordPolicies -notlike '*DisablePasswordExpiration*') -and ($domainPolicy)) {
+                    [PSCustomObject]@{
+                        id                     = $user.id
+                        displayName            = $user.displayName
+                        userPrincipalName      = $user.userPrincipalName
+                        passwordPolicies       = $user.passwordPolicies
+                        DomainPasswordValidity = $domainPolicy.passwordValidityPeriodInDays
+                    }
+                }
+            }
+        }
+
+        if ($misconfiguredDomains -or $misconfiguredUsers) {
+            $passed = 'Failed'
+            $testResultMarkdown = 'Found domains or users with password expiration still enabled.'
+        } else {
+            $passed = 'Passed'
+            $testResultMarkdown = 'Password expiration is properly disabled across all domains and users.'
+        }
+
+        if ($misconfiguredDomains) {
+            $reportTitle1 = 'Domains with password expiration enabled'
+            $mdInfo1 = "`n## $reportTitle1`n`n"
+            $mdInfo1 += "| Domain Name | Password Validity Interval |`n"
+            $mdInfo1 += "| :---------- | :------------------------- |`n"
+
+            foreach ($domain in $misconfiguredDomains) {
+                $mdInfo1 += "| $($domain.id) | $($domain.passwordValidityPeriodInDays) |`n"
+            }
+
+            $testResultMarkdown = $testResultMarkdown + $mdInfo1
+        }
+
+        if ($misconfiguredUsers) {
+            $reportTitle2 = 'Users with password expiration enabled'
+            $mdInfo2 = "`n## $reportTitle2`n`n"
+            $mdInfo2 += "| Display Name | User Principal Name | User Password Expiration setting | Domain Password Expiration setting |`n"
+            $mdInfo2 += "| :----------- | :------------------ | :------------------------------- | :--------------------------------- |`n"
+
+            foreach ($misconfiguredUser in $misconfiguredUsers) {
+                $displayName = $misconfiguredUser.displayName
+                $userPrincipalName = $misconfiguredUser.userPrincipalName
+                $userPasswordExpiration = $misconfiguredUser.passwordPolicies
+                $domainPasswordExpiration = $misconfiguredUser.DomainPasswordValidity
+                $mdInfo2 += "| $displayName | $userPrincipalName | $userPasswordExpiration | $domainPasswordExpiration |`n"
+            }
+
+            $testResultMarkdown = $testResultMarkdown + $mdInfo2
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21811' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'Medium' -Name 'Password expiration is disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential Management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21811' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Password expiration is disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21812.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21812.md
new file mode 100644
index 000000000000..53d298d4756b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21812.md
@@ -0,0 +1,7 @@
+An excessive number of Global Administrator accounts creates an expanded attack surface that threat actors can exploit through various initial access vectors. Each extra privileged account represents a potential entry point for threat actors. An excess of Global Administrator accounts undermines the principle of least privilege. Microsoft recommends that organizations have no more than eight Global Administrators.
+
+**Remediation action**
+
+- [Follow best practices for Microsoft Entra roles](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21812.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21812.ps1
new file mode 100644
index 000000000000..5bd0291730a5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21812.ps1
@@ -0,0 +1,60 @@
+function Invoke-CippTestZTNA21812 {
+    <#
+    .SYNOPSIS
+    Maximum number of Global Administrators doesn't exceed five users
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    $TestId = 'ZTNA21812'
+
+    try {
+        $AllGlobalAdmins = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId '62e90394-69f5-4237-9190-012177145e10'
+
+        $GlobalAdmins = @($AllGlobalAdmins | Where-Object { $_.'@odata.type' -in @('#microsoft.graph.user', '#microsoft.graph.servicePrincipal') })
+
+        $Passed = $GlobalAdmins.Count -le 5
+
+        if ($Passed) {
+            $ResultMarkdown = "Maximum number of Global Administrators doesn't exceed five users/service principals.`n`n"
+        } else {
+            $ResultMarkdown = "Maximum number of Global Administrators exceeds five users/service principals.`n`n"
+        }
+
+        if ($GlobalAdmins.Count -gt 0) {
+            $ResultMarkdown += "## Global Administrators`n`n"
+            $ResultMarkdown += "### Total number of Global Administrators: $($GlobalAdmins.Count)`n`n"
+            $ResultMarkdown += "| Display Name | Object Type | User Principal Name |`n"
+            $ResultMarkdown += "| :----------- | :---------- | :------------------ |`n"
+
+            foreach ($GlobalAdmin in $GlobalAdmins) {
+                $DisplayName = $GlobalAdmin.displayName
+                $ObjectType = switch ($GlobalAdmin.'@odata.type') {
+                    '#microsoft.graph.user' { 'User' }
+                    '#microsoft.graph.servicePrincipal' { 'Service Principal' }
+                    default { 'Unknown' }
+                }
+                $UserPrincipalName = if ($GlobalAdmin.userPrincipalName) { $GlobalAdmin.userPrincipalName } else { 'N/A' }
+
+                $PortalLink = switch ($ObjectType) {
+                    'User' { "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($GlobalAdmin.id)" }
+                    'Service Principal' { "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationMenuBlade/~/Overview/appId/$($GlobalAdmin.id)" }
+                    default { 'https://entra.microsoft.com' }
+                }
+
+                $ResultMarkdown += "| [$DisplayName]($PortalLink) | $ObjectType | $UserPrincipalName |`n"
+            }
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'Low' -Name "Maximum number of Global Administrators doesn't exceed five users" -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Privileged access'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name "Maximum number of Global Administrators doesn't exceed five users" -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Privileged access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.md
new file mode 100644
index 000000000000..4071a19bede4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.md
@@ -0,0 +1,8 @@
+When organizations maintain a disproportionately high ratio of Global Administrators relative to their total privileged user population, they expose themselves to significant security risks that threat actors might exploit through various attack vectors. Excessive Global Administrator assignments create multiple high-value targets for threat actors who might leverage initial access through credential compromise, phishing attacks, or insider threats to gain unrestricted access to the entire Microsoft Entra ID tenant and connected Microsoft 365 services. 
+
+**Remediation action**
+
+- [Minimize the number of Global Administrator role assignments](https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#5-limit-the-number-of-global-administrators-to-less-than-5)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1
new file mode 100644
index 000000000000..84552c025074
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21813.ps1
@@ -0,0 +1,145 @@
+function Invoke-CippTestZTNA21813 {
+    <#
+    .SYNOPSIS
+    High Global Administrator to privileged user ratio
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    $TestId = 'ZTNA21813'
+
+    try {
+        $GlobalAdminRoleId = '62e90394-69f5-4237-9190-012177145e10'
+
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+        $RoleAssignmentScheduleInstances = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleAssignmentScheduleInstances'
+        $RoleEligibilitySchedules = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleEligibilitySchedules'
+        $Users = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users'
+
+        $AllGAUsers = @{}
+        $AllPrivilegedUsers = @{}
+        $UserRoleMap = @{}
+
+        foreach ($Role in $PrivilegedRoles) {
+            $ActiveAssignments = $RoleAssignmentScheduleInstances | Where-Object {
+                $_.roleDefinitionId -eq $Role.templateId -and $_.assignmentType -eq 'Assigned'
+            }
+            $EligibleAssignments = $RoleEligibilitySchedules | Where-Object {
+                $_.roleDefinitionId -eq $Role.templateId
+            }
+
+            $AllAssignments = @($ActiveAssignments) + @($EligibleAssignments)
+
+            foreach ($Assignment in $AllAssignments) {
+                $User = $Users | Where-Object { $_.id -eq $Assignment.principalId } | Select-Object -First 1
+                if (-not $User) { continue }
+
+                $UserId = $User.id
+                $IsGARole = $Role.templateId -eq $GlobalAdminRoleId
+
+                if ($IsGARole) {
+                    $AllGAUsers[$UserId] = $User
+                }
+
+                if (-not $IsGARole) {
+                    $AllPrivilegedUsers[$UserId] = $User
+                }
+
+                if (-not $UserRoleMap.ContainsKey($UserId)) {
+                    $UserRoleMap[$UserId] = @{
+                        User  = $User
+                        Roles = [System.Collections.ArrayList]@()
+                        IsGA  = $false
+                    }
+                }
+
+                if ($Role.displayName -notin $UserRoleMap[$UserId].Roles) {
+                    [void]$UserRoleMap[$UserId].Roles.Add($Role.displayName)
+                }
+
+                if ($IsGARole) {
+                    $UserRoleMap[$UserId].IsGA = $true
+                }
+            }
+        }
+
+        $GARoleAssignmentCount = $AllGAUsers.Count
+        $PrivilegedRoleAssignmentCount = $AllPrivilegedUsers.Count
+        $TotalPrivilegedRoleAssignmentCount = $GARoleAssignmentCount + $PrivilegedRoleAssignmentCount
+
+        if ($TotalPrivilegedRoleAssignmentCount -gt 0) {
+            $GAPercentage = [math]::Round(($GARoleAssignmentCount / $TotalPrivilegedRoleAssignmentCount) * 100, 2)
+            $OtherPercentage = [math]::Round(($PrivilegedRoleAssignmentCount / $TotalPrivilegedRoleAssignmentCount) * 100, 2)
+        } else {
+            $GAPercentage = 0
+            $OtherPercentage = 0
+        }
+
+        $HasHealthyRatio = $false
+        $HasModerateRatio = $false
+        $HasHighRatio = $false
+        $CustomStatus = $null
+
+        if ($GAPercentage -lt 30) {
+            $StatusIndicator = '✅ Passed'
+            $HasHealthyRatio = $true
+        } elseif ($GAPercentage -ge 30 -and $GAPercentage -lt 50) {
+            $StatusIndicator = '⚠️ Investigate'
+            $HasModerateRatio = $true
+        } else {
+            $StatusIndicator = '❌ Failed'
+            $HasHighRatio = $true
+        }
+
+        $MdInfo = "`n## Privileged role assignment summary`n`n"
+        $MdInfo += "**Global administrator role count:** $GARoleAssignmentCount ($GAPercentage%) - $StatusIndicator`n`n"
+        $MdInfo += "**Other privileged role count:** $PrivilegedRoleAssignmentCount ($OtherPercentage%)`n`n"
+
+        $MdInfo += "## User privileged role assignments`n`n"
+        $MdInfo += "| User | Global administrator | Other Privileged Role(s) |`n"
+        $MdInfo += "| :--- | :------------------- | :------ |`n"
+
+        $SortedUsers = $UserRoleMap.Values | Sort-Object @{Expression = { -not $_.IsGA } }, @{Expression = { $_.User.displayName } }
+
+        foreach ($UserEntry in $SortedUsers) {
+            $User = $UserEntry.User
+            $IsGA = if ($UserEntry.IsGA) { 'Yes' } else { 'No' }
+
+            $OtherRoles = $UserEntry.Roles | Where-Object { $_ -ne 'Global Administrator' } | Sort-Object
+            $RolesList = if ($OtherRoles.Count -gt 0) { ($OtherRoles -join ', ') } else { '-' }
+
+            $UserLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($User.id)/hidePreviewBanner~/true"
+            $MdInfo += "| [$($User.displayName)]($UserLink) | $IsGA | $RolesList |`n"
+        }
+
+        if ($UserRoleMap.Count -eq 0) {
+            $MdInfo += "| No privileged users found | - | - |`n"
+        }
+
+        if ($TotalPrivilegedRoleAssignmentCount -eq 0) {
+            $Passed = $true
+            $ResultMarkdown = "No privileged role assignments found in the tenant.$MdInfo"
+        } elseif ($HasHealthyRatio) {
+            $Passed = $true
+            $ResultMarkdown = "Less than 30% of privileged role assignments in the tenant are Global Administrator.$MdInfo"
+        } elseif ($HasModerateRatio) {
+            $Passed = $false
+            $CustomStatus = 'Investigate'
+            $ResultMarkdown = "Between 30-50% of privileged role assignments in the tenant are Global Administrator.$MdInfo"
+        } else {
+            $Passed = $false
+            $ResultMarkdown = "More than 50% of privileged role assignments in the tenant are Global Administrator.$MdInfo"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'High Global Administrator to privileged user ratio' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'High Global Administrator to privileged user ratio' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21814.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21814.md
new file mode 100644
index 000000000000..9892d3765a35
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21814.md
@@ -0,0 +1,15 @@
+If an on-premises account is compromised and is synchronized to Microsoft Entra, the attacker might gain access to the tenant as well. This risk increases because on-premises environments typically have more attack surfaces due to older infrastructure and limited security controls. Attackers might also target the infrastructure and tools used to enable connectivity between on-premises environments and Microsoft Entra. These targets might include tools like Microsoft Entra Connect or Active Directory Federation Services, where they could impersonate or otherwise manipulate other on-premises user accounts.
+
+If privileged cloud accounts are synchronized with on-premises accounts, an attacker who acquires credentials for on-premises can use those same credentials to access cloud resources and move laterally to the cloud environment.
+
+**Remediation action**
+
+- [Protecting Microsoft 365 from on-premises attacks](https://learn.microsoft.com/entra/architecture/protect-m365-from-on-premises-attacks?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#specific-security-recommendations)
+
+For each role with high privileges (assigned permanently or eligible through Microsoft Entra Privileged Identity Management), you should do the following actions:
+
+- Review the users that have onPremisesImmutableId and onPremisesSyncEnabled set. See [Microsoft Graph API user resource type](https://learn.microsoft.com/graph/api/resources/user?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+- Create cloud-only user accounts for those individuals and remove their hybrid identity from privileged roles.
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21814.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21814.ps1
new file mode 100644
index 000000000000..6a4324dc6302
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21814.ps1
@@ -0,0 +1,75 @@
+function Invoke-CippTestZTNA21814 {
+    <#
+    .SYNOPSIS
+    Privileged accounts are cloud native identities
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+
+    $TestId = 'ZTNA21814'
+
+    try {
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+        $Users = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users'
+
+        $RoleData = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Role in $PrivilegedRoles) {
+            $RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $Role.RoletemplateId
+            $RoleUsers = $RoleMembers | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.user' }
+
+            foreach ($RoleMember in $RoleUsers) {
+                $UserDetail = $Users | Where-Object { $_.id -eq $RoleMember.id } | Select-Object -First 1
+
+                if ($UserDetail) {
+                    $RoleData.Add([PSCustomObject]@{
+                            RoleName              = $Role.displayName
+                            UserId                = $UserDetail.id
+                            UserDisplayName       = $UserDetail.displayName
+                            UserPrincipalName     = $UserDetail.userPrincipalName
+                            OnPremisesSyncEnabled = $UserDetail.onPremisesSyncEnabled
+                        })
+                }
+            }
+        }
+
+        $SyncedUsers = $RoleData | Where-Object { $_.OnPremisesSyncEnabled -eq $true }
+        $Passed = $SyncedUsers.Count -eq 0
+
+        if ($Passed) {
+            $ResultMarkdown = "Validated that standing or eligible privileged accounts are cloud only accounts.`n`n"
+        } else {
+            $ResultMarkdown = "This tenant has $($SyncedUsers.Count) privileged users that are synced from on-premise.`n`n"
+        }
+
+        if ($RoleData.Count -gt 0) {
+            $ResultMarkdown += "## Privileged Roles`n`n"
+            $ResultMarkdown += "| Role Name | User | Source | Status |`n"
+            $ResultMarkdown += "| :--- | :--- | :--- | :---: |`n"
+
+            foreach ($RoleUser in ($RoleData | Sort-Object RoleName, UserDisplayName)) {
+                if ($RoleUser.OnPremisesSyncEnabled) {
+                    $Type = 'Synced from on-premise'
+                    $Status = '❌'
+                } else {
+                    $Type = 'Cloud native identity'
+                    $Status = '✅'
+                }
+
+                $UserLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($RoleUser.UserId)"
+                $ResultMarkdown += "| $($RoleUser.RoleName) | [$($RoleUser.UserDisplayName)]($UserLink) | $Type | $Status |`n"
+            }
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Privileged accounts are cloud native identities' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Privileged accounts are cloud native identities' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21815.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21815.md
new file mode 100644
index 000000000000..a2b1ef6e0a15
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21815.md
@@ -0,0 +1,10 @@
+Threat actors target privileged accounts because they have access to the data and resources they want. This might include more access to your Microsoft Entra tenant, data in Microsoft SharePoint, or the ability to establish long-term persistence. Without a just-in-time (JIT) activation model, administrative privileges remain continuously exposed, providing attackers with an extended window to operate undetected. Just-in-time access mitigates risk by enforcing time-limited privilege activation with extra controls such as approvals, justification, and Conditional Access policy, ensuring that high-risk permissions are granted only when needed and for a limited duration. This restriction minimizes the attack surface, disrupts lateral movement, and forces adversaries to trigger actions that can be specially monitored and denied when not expected. Without just-in-time access, compromised admin accounts grant indefinite control, letting attackers disable security controls, erase logs, and maintain stealth, amplifying the impact of a compromise.
+
+Use Microsoft Entra Privileged Identity Management (PIM) to provide time-bound just-in-time access to privileged role assignments. Use access reviews in Microsoft Entra ID Governance to regularly review privileged access to ensure continued need.
+
+**Remediation action**
+
+- [Start using Privileged Identity Management](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-getting-started?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Create an access review of Azure resource and Microsoft Entra roles in PIM](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-create-roles-and-resource-roles-review?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21815.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21815.ps1
new file mode 100644
index 000000000000..cb7eeca9b2f4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21815.ps1
@@ -0,0 +1,66 @@
+function Invoke-CippTestZTNA21815 {
+    <#
+    .SYNOPSIS
+    All privileged role assignments are activated just in time and not permanently active
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #tested
+    $TestId = 'ZTNA21815'
+
+    try {
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+        $RoleAssignmentScheduleInstances = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleAssignmentScheduleInstances'
+        $Users = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users'
+
+        $PermanentAssignments = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Role in $PrivilegedRoles) {
+            $ActiveAssignments = $RoleAssignmentScheduleInstances | Where-Object {
+                $_.roleDefinitionId -eq $Role.RoletemplateId -and
+                $_.assignmentType -eq 'Assigned' -and
+                $null -eq $_.endDateTime
+            }
+
+            foreach ($Assignment in $ActiveAssignments) {
+                $User = $Users | Where-Object { $_.id -eq $Assignment.principalId } | Select-Object -First 1
+                if (-not $User) { continue }
+
+                $PermanentAssignments.Add([PSCustomObject]@{
+                        PrincipalDisplayName = $User.displayName
+                        UserPrincipalName    = $User.userPrincipalName
+                        PrincipalId          = $User.id
+                        RoleDisplayName      = $Role.displayName
+                        PrivilegeType        = 'Permanent'
+                    })
+            }
+        }
+
+        if ($PermanentAssignments.Count -eq 0) {
+            $Passed = $true
+            $ResultMarkdown = 'No privileged users have permanent role assignments.'
+        } else {
+            $Passed = $false
+            $ResultMarkdown = "Privileged users with permanent role assignments were found.`n`n"
+            $ResultMarkdown += "## Privileged users with permanent role assignments`n`n"
+            $ResultMarkdown += "| User | UPN | Role Name | Assignment Type |`n"
+            $ResultMarkdown += "| :--- | :-- | :-------- | :-------------- |`n"
+
+            foreach ($Result in $PermanentAssignments) {
+                $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($Result.PrincipalId)/hidePreviewBanner~/true"
+                $ResultMarkdown += "| [$($Result.PrincipalDisplayName)]($PortalLink) | $($Result.UserPrincipalName) | $($Result.RoleDisplayName) | $($Result.PrivilegeType) |`n"
+            }
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'All privileged role assignments are activated just in time and not permanently active' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Privileged access'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'All privileged role assignments are activated just in time and not permanently active' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Privileged access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.md
new file mode 100644
index 000000000000..0a29cd021f6a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.md
@@ -0,0 +1,8 @@
+Threat actors who compromise a permanently assigned privileged account (e.g., Global Administrator or Privileged Role Administrator) gain continuous, uninterrupted access to high-impact directory operations. This extended dwell time enables attackers to more easily establish persistent backdoors, delete critical data and security configurations, disable monitoring systems, and register malicious applications for data exfiltration and lateral movement. These actions can result in full organizational disruption, widespread data compromise, and total loss of operational control over the tenant. Microsoft Entra PIM’s eligible role assignment model narrows escalation pathways, constrains attacker dwell time and provides the option of role elevation approval workflows.
+
+**Remediation action**
+- [Use Privileged Identity Management to manage privileged Microsoft Entra roles](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-getting-started)
+- [Manage emergency access admin accounts](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access) 
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1
new file mode 100644
index 000000000000..659a9e6d239d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21816.ps1
@@ -0,0 +1,184 @@
+function Invoke-CippTestZTNA21816 {
+    <#
+    .SYNOPSIS
+    All Microsoft Entra privileged role assignments are managed with PIM
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    $TestId = 'ZTNA21816'
+
+    try {
+        $GlobalAdminRoleId = '62e90394-69f5-4237-9190-012177145e10'
+        $PermanentGAUserList = [System.Collections.Generic.List[object]]::new()
+        $PermanentGAGroupList = [System.Collections.Generic.List[object]]::new()
+        $NonPIMPrivilegedUsers = [System.Collections.Generic.List[object]]::new()
+        $NonPIMPrivilegedGroups = [System.Collections.Generic.List[object]]::new()
+
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+        $RoleEligibilitySchedules = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleEligibilitySchedules'
+        $RoleAssignmentScheduleInstances = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleAssignmentScheduleInstances'
+        $Users = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users'
+        $Groups = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Groups'
+
+        $EligibleGAs = $RoleEligibilitySchedules | Where-Object { $_.roleDefinitionId -eq $GlobalAdminRoleId }
+        $EligibleGAUsers = 0
+
+        foreach ($EligibleGA in $EligibleGAs) {
+            $Principal = $Users | Where-Object { $_.id -eq $EligibleGA.principalId } | Select-Object -First 1
+            if ($Principal) {
+                $EligibleGAUsers++
+            } else {
+                $GroupPrincipal = $Groups | Where-Object { $_.id -eq $EligibleGA.principalId } | Select-Object -First 1
+                if ($GroupPrincipal) {
+                    $GroupMembers = $Users | Where-Object { $_.id -in $GroupPrincipal.members }
+                    $EligibleGAUsers = $EligibleGAUsers + $GroupMembers.Count
+                }
+            }
+        }
+
+        foreach ($Role in $PrivilegedRoles) {
+            if ($Role.templateId -eq $GlobalAdminRoleId) { continue }
+
+            $RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $Role.RoletemplateId
+
+            foreach ($Member in $RoleMembers) {
+                $Assignment = $RoleAssignmentScheduleInstances | Where-Object {
+                    $_.principalId -eq $Member.id -and $_.roleDefinitionId -eq $Role.RoletemplateId
+                } | Select-Object -First 1
+
+                if (-not $Assignment -or ($Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime)) {
+                    $MemberInfo = [PSCustomObject]@{
+                        displayName       = $Member.displayName
+                        userPrincipalName = $Member.userPrincipalName
+                        id                = $Member.id
+                        roleTemplateId    = $Role.RoletemplateId
+                        roleName          = $Role.displayName
+                        assignmentType    = if ($Assignment) { $Assignment.assignmentType } else { 'Not in PIM' }
+                    }
+
+                    if ($Member.'@odata.type' -eq '#microsoft.graph.user') {
+                        $NonPIMPrivilegedUsers.Add($MemberInfo)
+                    } else {
+                        $NonPIMPrivilegedGroups.Add($MemberInfo)
+                    }
+                }
+            }
+        }
+
+        $GAMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId $GlobalAdminRoleId
+
+        foreach ($Member in $GAMembers) {
+            $Assignment = $RoleAssignmentScheduleInstances | Where-Object {
+                $_.principalId -eq $Member.id -and $_.roleDefinitionId -eq $GlobalAdminRoleId
+            } | Select-Object -First 1
+
+            if (-not $Assignment -or ($Assignment.assignmentType -eq 'Assigned' -and $null -eq $Assignment.endDateTime)) {
+                $MemberInfo = [PSCustomObject]@{
+                    displayName           = $Member.displayName
+                    userPrincipalName     = $Member.userPrincipalName
+                    id                    = $Member.id
+                    roleTemplateId        = $GlobalAdminRoleId
+                    roleName              = 'Global Administrator'
+                    assignmentType        = if ($Assignment) { $Assignment.assignmentType } else { 'Not in PIM' }
+                    onPremisesSyncEnabled = $null
+                }
+
+                if ($Member.'@odata.type' -eq '#microsoft.graph.user') {
+                    $UserDetail = $Users | Where-Object { $_.id -eq $Member.id } | Select-Object -First 1
+                    if ($UserDetail) {
+                        $MemberInfo.onPremisesSyncEnabled = $UserDetail.onPremisesSyncEnabled
+                    }
+                    $PermanentGAUserList.Add($MemberInfo)
+                } elseif ($Member.'@odata.type' -eq '#microsoft.graph.group') {
+                    $PermanentGAGroupList.Add($MemberInfo)
+
+                    $Group = $Groups | Where-Object { $_.id -eq $Member.id } | Select-Object -First 1
+                    if ($Group) {
+                        $GroupMembers = $Users | Where-Object { $_.id -in $Group.members }
+                        foreach ($GroupMember in $GroupMembers) {
+                            $GroupMemberInfo = [PSCustomObject]@{
+                                displayName           = $GroupMember.displayName
+                                userPrincipalName     = $GroupMember.userPrincipalName
+                                id                    = $GroupMember.id
+                                roleTemplateId        = $GlobalAdminRoleId
+                                roleName              = 'Global Administrator (via group)'
+                                assignmentType        = 'Via Group'
+                                onPremisesSyncEnabled = $GroupMember.onPremisesSyncEnabled
+                            }
+                            $PermanentGAUserList.Add($GroupMemberInfo)
+                        }
+                    }
+                }
+            }
+        }
+
+        $HasPIMUsage = $EligibleGAUsers -gt 0
+        $HasNonPIMPrivileged = ($NonPIMPrivilegedUsers.Count + $NonPIMPrivilegedGroups.Count) -gt 0
+        $PermanentGACount = $PermanentGAUserList.Count
+        $CustomStatus = $null
+
+        if (-not $HasPIMUsage) {
+            $Passed = $false
+            $ResultMarkdown = 'No eligible Global Administrator assignments found. PIM usage cannot be confirmed.'
+        } elseif ($HasNonPIMPrivileged) {
+            $Passed = $false
+            $ResultMarkdown = 'Found Microsoft Entra privileged role assignments that are not managed with PIM.'
+        } elseif ($PermanentGACount -gt 2) {
+            $Passed = $false
+            $CustomStatus = 'Investigate'
+            $ResultMarkdown = 'Three or more accounts are permanently assigned the Global Administrator role. Review to determine whether these are emergency access accounts.'
+        } else {
+            $Passed = $true
+            $ResultMarkdown = 'All Microsoft Entra privileged role assignments are managed with PIM with the exception of up to two standing Global Administrator accounts.'
+        }
+
+        $ResultMarkdown += "`n`n## Assessment summary`n`n"
+        $ResultMarkdown += "| Metric | Count |`n"
+        $ResultMarkdown += "| :----- | :---- |`n"
+        $ResultMarkdown += "| Privileged roles found | $($PrivilegedRoles.Count) |`n"
+        $ResultMarkdown += "| Eligible Global Administrators | $EligibleGAUsers |`n"
+        $ResultMarkdown += "| Non-PIM privileged users | $($NonPIMPrivilegedUsers.Count) |`n"
+        $ResultMarkdown += "| Non-PIM privileged groups | $($NonPIMPrivilegedGroups.Count) |`n"
+        $ResultMarkdown += "| Permanent Global Administrator users | $($PermanentGAUserList.Count) |`n"
+
+        if ($NonPIMPrivilegedUsers.Count -gt 0 -or $NonPIMPrivilegedGroups.Count -gt 0) {
+            $ResultMarkdown += "`n## Non-PIM managed privileged role assignments`n`n"
+            $ResultMarkdown += "| Display name | User principal name | Role name | Assignment type |`n"
+            $ResultMarkdown += "| :----------- | :------------------ | :-------- | :-------------- |`n"
+
+            foreach ($User in $NonPIMPrivilegedUsers) {
+                $UserLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($User.id)/hidePreviewBanner~/true"
+                $ResultMarkdown += "| [$($User.displayName)]($UserLink) | $($User.userPrincipalName) | $($User.roleName) | $($User.assignmentType) |`n"
+            }
+
+            foreach ($Group in $NonPIMPrivilegedGroups) {
+                $GroupLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/GroupDetailsMenuBlade/~/RolesAndAdministrators/groupId/$($Group.id)/menuId/"
+                $ResultMarkdown += "| [$($Group.displayName)]($GroupLink) | N/A (Group) | $($Group.roleName) | $($Group.assignmentType) |`n"
+            }
+        }
+
+        if ($PermanentGAUserList.Count -gt 0) {
+            $ResultMarkdown += "`n## Permanent Global Administrator assignments`n`n"
+            $ResultMarkdown += "| Display name | User principal name | Assignment type | On-Premises synced |`n"
+            $ResultMarkdown += "| :----------- | :------------------ | :-------------- | :----------------- |`n"
+
+            foreach ($User in $PermanentGAUserList) {
+                $SyncStatus = if ($null -ne $User.onPremisesSyncEnabled) { $User.onPremisesSyncEnabled } else { 'N/A' }
+                $UserLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/AdministrativeRole/userId/$($User.id)/hidePreviewBanner~/true"
+                $ResultMarkdown += "| [$($User.displayName)]($UserLink) | $($User.userPrincipalName) | $($User.assignmentType) | $SyncStatus |`n"
+            }
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'All Microsoft Entra privileged role assignments are managed with PIM' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Identity'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'All Microsoft Entra privileged role assignments are managed with PIM' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Identity'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21817.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21817.md
new file mode 100644
index 000000000000..b0b563352276
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21817.md
@@ -0,0 +1,13 @@
+Without approval workflows, threat actors who compromise Global Administrator credentials through phishing, credential stuffing, or other authentication bypass techniques can immediately activate the most privileged role in a tenant without any other verification or oversight. Privileged Identity Management (PIM) allows eligible role activations to become active within seconds, so compromised credentials can allow near-instant privilege escalation. Once activated, threat actors can use the Global Administrator role to use the following attack paths to gain persistent access to the tenant:
+- Create new privileged accounts
+- Modify Conditional Access policies to exclude those new accounts
+- Establish alternate authentication methods such as certificate-based authentication or application registrations with high privileges
+
+The Global Administrator role provides access to administrative features in Microsoft Entra ID and services that use Microsoft Entra identities, including Microsoft Defender XDR, Microsoft Purview, Exchange Online, and SharePoint Online. Without approval gates, threat actors can rapidly escalate to complete tenant takeover, exfiltrating sensitive data, compromising all user accounts, and establishing long-term backdoors through service principals or federation modifications that persist even after the initial compromise is detected. 
+
+**Remediation action**
+
+- [Configure role settings to require approval for Global Administrator activation](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Set up approval workflow for privileged roles](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-approval-workflow?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21817.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21817.ps1
new file mode 100644
index 000000000000..cfe4f469749a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21817.ps1
@@ -0,0 +1,80 @@
+function Invoke-CippTestZTNA21817 {
+    <#
+    .SYNOPSIS
+    Global Administrator role activation triggers an approval workflow
+    #>
+    param($Tenant)
+
+    try {
+        $RoleManagementPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleManagementPolicies'
+
+        if (-not $RoleManagementPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21817' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Global Administrator role activation triggers an approval workflow' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+            return
+        }
+
+        $globalAdminRoleId = '62e90394-69f5-4237-9190-012177145e10'
+
+        $globalAdminPolicy = $RoleManagementPolicies | Where-Object {
+            $_.scopeId -eq '/' -and
+            $_.scopeType -eq 'DirectoryRole' -and
+            $_.roleDefinitionId -eq $globalAdminRoleId
+        }
+
+        $tableRows = ''
+        $result = $false
+
+        if ($globalAdminPolicy) {
+            $approvalRule = $globalAdminPolicy.rules | Where-Object { $_.id -like '*Approval_EndUser_Assignment*' }
+
+            if ($approvalRule -and $approvalRule.setting.isApprovalRequired -eq $true) {
+                $approverCount = 0
+                foreach ($stage in $approvalRule.setting.approvalStages) {
+                    $approverCount = $approverCount + ($stage.primaryApprovers | Measure-Object).Count
+                }
+
+                if ($approverCount -gt 0) {
+                    $result = $true
+                    $testResultMarkdown = "✅ **Pass**: Approval required with $approverCount primary approver(s) configured.`n`n%TestResult%"
+                    $primaryApprovers = ($approvalRule.setting.approvalStages[0].primaryApprovers.description -join ', ')
+                    $escalationApprovers = ($approvalRule.setting.approvalStages[0].escalationApprovers.description -join ', ')
+                    $tableRows = "| Yes | $primaryApprovers | $escalationApprovers |`n"
+                } else {
+                    $testResultMarkdown = "❌ **Fail**: Approval required but no approvers configured.`n`n%TestResult%"
+                    $tableRows = "| Yes | None | None |`n"
+                }
+            } else {
+                $testResultMarkdown = "❌ **Fail**: Approval not required for Global Administrator role activation.`n`n%TestResult%"
+                $tableRows = "| No | N/A | N/A |`n"
+            }
+        } else {
+            $testResultMarkdown = "❌ **Fail**: No PIM policy found for Global Administrator role.`n`n%TestResult%"
+            $tableRows = "| N/A | N/A | N/A |`n"
+        }
+
+        $passed = $result
+
+        $reportTitle = 'Global Administrator role activation and approval workflow'
+
+        $formatTemplate = @'
+
+## {0}
+
+
+| Approval Required | Primary Approvers | Escalation Approvers |
+| :---------------- | :---------------- | :------------------- |
+{1}
+
+'@
+
+        $mdInfo = $formatTemplate -f $reportTitle, $tableRows
+        $testResultMarkdown = $testResultMarkdown -replace '%TestResult%', $mdInfo
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21817' -TestType 'Identity' -Status $(if ($passed) { 'Passed' } else { 'Failed' }) -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Global Administrator role activation triggers an approval workflow' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21817' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Global Administrator role activation triggers an approval workflow' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application Management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.md
new file mode 100644
index 000000000000..4432e91f337a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.md
@@ -0,0 +1,8 @@
+Organizations without proper activation alerts for highly privileged roles lack visibility into when users access these critical permissions. Threat actors can exploit this monitoring gap to perform privilege escalation by activating highly privileged roles without detection, then establish persistence through admin account creation or security policy modifications. The absence of real-time alerts enables attackers to conduct lateral movement, modify audit configurations, and disable security controls without triggering immediate response procedures.
+
+**Remediation action**
+
+- [Configure Microsoft Entra role settings in Privileged Identity Management](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#require-justification-on-activation)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1
new file mode 100644
index 000000000000..b739f447cf85
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21818.ps1
@@ -0,0 +1,119 @@
+function Invoke-CippTestZTNA21818 {
+    <#
+    .SYNOPSIS
+    Privileged role activations have monitoring and alerting configured
+    #>
+    [CmdletBinding()]
+    param (
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    $TestId = 'ZTNA21818'
+
+    try {
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+        $RoleManagementPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleManagementPolicies'
+
+        $Notifications = @(
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when members are assigned as eligible to this role'
+                NotificationType     = 'Role assignment alert'
+                RuleId               = 'Notification_Admin_Admin_Eligibility'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when members are assigned as eligible to this role'
+                NotificationType     = 'Notification to the assigned user (assignee)'
+                RuleId               = 'Notification_Requestor_Admin_Eligibility'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when members are assigned as eligible to this role'
+                NotificationType     = 'Request to approve a role assignment renewal/extension'
+                RuleId               = 'Notification_Approver_Admin_Eligibility'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when members are assigned as active to this role'
+                NotificationType     = 'Role assignment alert'
+                RuleId               = 'Notification_Admin_Admin_Assignment'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when members are assigned as active to this role'
+                NotificationType     = 'Notification to the assigned user (assignee)'
+                RuleId               = 'Notification_Requestor_Admin_Assignment'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when members are assigned as active to this role'
+                NotificationType     = 'Request to approve a role assignment renewal/extension'
+                RuleId               = 'Notification_Approver_Admin_Assignment'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when eligible members activate this role'
+                NotificationType     = 'Role activation alert'
+                RuleId               = 'Notification_Admin_EndUser_Assignment'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when eligible members activate this role'
+                NotificationType     = 'Notification to activated user (requestor)'
+                RuleId               = 'Notification_Requestor_EndUser_Assignment'
+            }
+            [PSCustomObject]@{
+                NotificationScenario = 'Send notifications when eligible members activate this role'
+                NotificationType     = 'Request to approve an activation'
+                RuleId               = 'Notification_Approver_EndUser_Assignment'
+            }
+        )
+
+        $NotificationRules = [System.Collections.Generic.List[object]]::new()
+        $Passed = $true
+        $ExitLoop = $false
+
+        foreach ($Role in $PrivilegedRoles) {
+            $Policy = $RoleManagementPolicies | Where-Object {
+                $_.scopeId -eq '/' -and $_.scopeType -eq 'DirectoryRole' -and $_.roleDefinitionId -eq $Role.id
+            } | Select-Object -First 1
+
+            if (-not $Policy) { continue }
+
+            foreach ($NotificationRuleId in $Notifications.RuleId) {
+                $Rule = $Policy.rules | Where-Object { $_.id -eq $NotificationRuleId } | Select-Object -First 1
+
+                if ($Rule) {
+                    $RuleWithRole = $Rule | Select-Object *, @{Name = 'RoleDisplayName'; Expression = { $Role.displayName } }
+                    $NotificationRules.Add($RuleWithRole)
+
+                    if ($Rule.isDefaultRecipientsEnabled -eq $true -and ($Rule.notificationRecipients.Count -eq 0 -or $null -eq $Rule.notificationRecipients)) {
+                        $Passed = $false
+                        $ExitLoop = $true
+                        break
+                    }
+                }
+            }
+
+            if ($ExitLoop) { break }
+        }
+
+        if ($Passed) {
+            $ResultMarkdown = "Role notifications are properly configured for privileged role.`n`n"
+        } else {
+            $ResultMarkdown = "Role notifications are not properly configured.`n`nNote: To save time, this check stops when it finds the first role that does not have notifications. After fixing this role and all other roles, we recommend running the check again to verify.`n`n"
+        }
+
+        $ResultMarkdown += "## Notifications for high privileged roles`n`n"
+        $ResultMarkdown += "| Role Name | Notification Scenario | Notification Type | Default Recipients Enabled | Additional Recipients |`n"
+        $ResultMarkdown += "| :-------- | :-------------------- | :---------------- | :------------------------- | :-------------------- |`n"
+
+        foreach ($NotificationRule in $NotificationRules) {
+            $MatchingNotification = $Notifications | Where-Object { $_.RuleId -eq $NotificationRule.id }
+            $Recipients = if ($NotificationRule.notificationRecipients) { ($NotificationRule.notificationRecipients -join ', ') } else { '' }
+            $ResultMarkdown += "| $($NotificationRule.roleDisplayName) | $($MatchingNotification.notificationScenario) | $($MatchingNotification.notificationType) | $($NotificationRule.isDefaultRecipientsEnabled) | $Recipients |`n"
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Privileged role activations have monitoring and alerting configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Monitoring'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Privileged role activations have monitoring and alerting configured' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Monitoring'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.md
new file mode 100644
index 000000000000..7f99f06ac13a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.md
@@ -0,0 +1,8 @@
+Without activation alerts for Global Administrator role assignments, threat actors can perform role activation without detection, allowing them to establish persistence in the environment. When Global Administrator roles are activated without notification mechanisms, threat actors who have compromised accounts can escalate privileges, bypassing security monitoring. The absence of alerts creates a blind spot where threat actors can activate the most privileged role in the tenant and perform actions such as creating backdoor accounts, modifying security policies, or accessing sensitive data without immediate detection. This lack of visibility allows threat actors to maintain access and execute their objectives while appearing to use legitimate administrative functions, making it difficult for security teams to distinguish between authorized and unauthorized privilege escalation activities.
+
+**Remediation action**
+
+- [Configure Microsoft Entra role settings in Privileged Identity Management](https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1
new file mode 100644
index 000000000000..8fe1afbea01c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21819.ps1
@@ -0,0 +1,85 @@
+function Invoke-CippTestZTNA21819 {
+    <#
+    .SYNOPSIS
+    Activation alert for Global Administrator role assignment
+    #>
+    param($Tenant)
+    #Tested
+    $TestId = 'ZTNA21819'
+
+    try {
+        # Get Global Administrator role (template ID: 62e90394-69f5-4237-9190-012177145e10)
+        $Roles = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Roles'
+        $GlobalAdminRole = $Roles | Where-Object { $_.roleTemplateId -eq '62e90394-69f5-4237-9190-012177145e10' }
+
+        if (-not $GlobalAdminRole) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Activation alert for Global Administrator role assignment' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+            return
+        }
+
+        # Get role management policy for Global Admin
+        $RoleManagementPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleManagementPolicies'
+        $GlobalAdminPolicy = $RoleManagementPolicies | Where-Object {
+            $_.scopeId -eq '/' -and $_.scopeType -eq 'DirectoryRole' -and $_.effectiveRules.target.targetObjects.id -contains $GlobalAdminRole.id
+        }
+
+        $Passed = 'Failed'
+        $IsDefaultRecipientsEnabled = 'N/A'
+        $Recipients = 'N/A'
+
+        if ($GlobalAdminPolicy) {
+            # Find the notification rule for requestor end-user assignment
+            $NotificationRule = $GlobalAdminPolicy.effectiveRules | Where-Object {
+                $_.id -like '*Notification_Requestor_EndUser_Assignment*'
+            }
+
+            if ($NotificationRule) {
+                $IsDefaultRecipientsEnabled = $NotificationRule.isDefaultRecipientsEnabled
+                $NotificationRecipients = $NotificationRule.notificationRecipients
+
+                if ($NotificationRecipients) {
+                    $Recipients = ($NotificationRecipients -join ', ')
+                }
+
+                if ($NotificationRecipients -or $IsDefaultRecipientsEnabled) {
+                    $Passed = 'Passed'
+                }
+            }
+        }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "Activation alerts are configured for Global Administrator role.`n`n"
+        } else {
+            $ResultMarkdown = "Activation alerts are missing or improperly configured for Global Administrator role.`n`n"
+        }
+
+        $ResultMarkdown += "| Role display name | Default recipients | Additional recipients |`n"
+        $ResultMarkdown += "| :---------------- | :----------------- | :------------------- |`n"
+
+        $RoleLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles'
+        $DisplayNameLink = "[$($GlobalAdminRole.displayName)]($RoleLink)"
+
+        $DefaultRecipientsStatus = if ($IsDefaultRecipientsEnabled -eq $true) {
+            '✅ Enabled'
+        } elseif ($IsDefaultRecipientsEnabled -eq $false) {
+            '❌ Disabled'
+        } else {
+            'N/A'
+        }
+
+        $RecipientsDisplay = if ([string]::IsNullOrEmpty($Recipients) -or $Recipients -eq 'N/A') {
+            '-'
+        } else {
+            $Recipients
+        }
+
+        $ResultMarkdown += "| $DisplayNameLink | $DefaultRecipientsStatus | $RecipientsDisplay |`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Low' -Name 'Activation alert for Global Administrator role assignment' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Activation alert for Global Administrator role assignment' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.md
new file mode 100644
index 000000000000..e6327b29dd4b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.md
@@ -0,0 +1,6 @@
+Without activation alerts for privileged role assignments, threat actors who compromise user credentials through phishing, password attacks, or credential stuffing can activate privileged roles without detection. When privileged roles are activated without notification mechanisms, security teams lack visibility into when elevated permissions are being used, allowing threat actors to operate within the environment undetected during the initial access phase. During the persistence phase, threat actors can leverage activated privileged roles to create backdoors, modify security configurations, or establish additional access methods without triggering security alerts. The lack of activation notifications prevents security teams from correlating privileged role usage with other security events, enabling threat actors to conduct lateral movement and privilege escalation activities while maintaining stealth.
+
+**Remediation action**
+- [Configure notifications for privileged roles](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings#require-justification-on-active-assignment)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1
new file mode 100644
index 000000000000..88b626c023dd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21820.ps1
@@ -0,0 +1,108 @@
+function Invoke-CippTestZTNA21820 {
+    <#
+    .SYNOPSIS
+    Activation alert for all privileged role assignments
+    #>
+    param($Tenant)
+    #Tested
+    $TestId = 'ZTNA21820'
+
+    try {
+        # Get all privileged roles
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+
+        if (-not $PrivilegedRoles -or $PrivilegedRoles.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Low' -Name 'Activation alert for all privileged role assignments' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+            return
+        }
+
+        # Get all role management policies
+        $RoleManagementPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RoleManagementPolicies'
+
+        # Build hashtable for quick policy lookup by role ID
+        $PolicyByRoleId = @{}
+        foreach ($Policy in $RoleManagementPolicies) {
+            if ($Policy.scopeId -eq '/' -and $Policy.scopeType -eq 'DirectoryRole') {
+                foreach ($RoleId in $Policy.effectiveRules.target.targetObjects.id) {
+                    if ($RoleId) {
+                        $PolicyByRoleId[$RoleId] = $Policy
+                    }
+                }
+            }
+        }
+
+        $RolesWithIssues = [System.Collections.Generic.List[object]]::new()
+        $Passed = 'Passed'
+
+        foreach ($Role in $PrivilegedRoles) {
+            $Policy = $PolicyByRoleId[$Role.id]
+
+            if (-not $Policy) {
+                $RolesWithIssues.Add(@{
+                        Role                       = $Role
+                        Issue                      = 'No PIM policy assignment found'
+                        IsDefaultRecipientsEnabled = 'N/A'
+                        NotificationRecipients     = 'N/A'
+                    })
+                continue
+            }
+
+            # Find notification rule for requestor end-user assignment
+            $NotificationRule = $Policy.effectiveRules | Where-Object {
+                $_.id -like '*Notification_Requestor_EndUser_Assignment*'
+            }
+
+            if ($NotificationRule) {
+                $IsDefaultRecipientsEnabled = $NotificationRule.isDefaultRecipientsEnabled
+                $NotificationRecipients = $NotificationRule.notificationRecipients
+
+                # Check if alert is properly configured
+                if ($IsDefaultRecipientsEnabled -eq $true -and ((-not $NotificationRecipients) -or $NotificationRecipients.Count -eq 0)) {
+                    $Passed = 'Failed'
+                    $RolesWithIssues.Add(@{
+                            Role                       = $Role
+                            IsDefaultRecipientsEnabled = $IsDefaultRecipientsEnabled
+                            NotificationRecipients     = 'N/A'
+                        })
+                    # Exit early on first issue for performance
+                    break
+                }
+            }
+        }
+
+        if ($RolesWithIssues.Count -eq 0) {
+            $ResultMarkdown = 'Activation alerts are configured for privileged role assignments.'
+        } else {
+            $ResultMarkdown = 'Activation alerts are missing or improperly configured for privileged roles.'
+        }
+
+        if ($RolesWithIssues.Count -gt 0) {
+            $ResultMarkdown += "`n`n## Roles with missing or misconfigured alerts`n`n"
+            $ResultMarkdown += "| Role display name | Default recipients | Additional recipients |`n"
+            $ResultMarkdown += "| :---------------- | :----------------- | :------------------- |`n"
+
+            foreach ($RoleIssue in $RolesWithIssues) {
+                $Role = $RoleIssue.Role
+                $RoleLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles'
+                $DisplayNameLink = "[$($Role.displayName)]($RoleLink)"
+
+                $DefaultRecipientsStatus = if ($RoleIssue.IsDefaultRecipientsEnabled -eq $true) {
+                    'Enabled'
+                } else {
+                    'Disabled'
+                }
+                $Recipients = $RoleIssue.NotificationRecipients
+
+                $ResultMarkdown += "| $DisplayNameLink | $DefaultRecipientsStatus | $Recipients |`n"
+            }
+            $ResultMarkdown += "`n`n*Not all misconfigured roles may be listed. For performance reasons, this assessment stops at the first detected issue.*`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Low' -Name 'Activation alert for all privileged role assignments' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Low' -Name 'Activation alert for all privileged role assignments' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Privileged access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21821.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21821.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21821.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21822.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21822.md
new file mode 100644
index 000000000000..506922d1426c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21822.md
@@ -0,0 +1,8 @@
+Without limiting guest access to approved tenants, threat actors can exploit unrestricted guest access to establish initial access through compromised external accounts or by creating accounts in untrusted tenants. Organizations can configure an allowlist or blocklist to control B2B collaboration invitations from specific organizations, and without these controls, threat actors can leverage social engineering techniques to obtain invitations from legitimate internal users. Once threat actors gain guest access through unrestricted domains, they can perform discovery activities to enumerate internal resources, users, and applications that guest accounts can access. The compromised guest account then serves as a persistent foothold, allowing threat actors to execute collection activities against accessible SharePoint sites, Teams channels, and other resources granted to guest users. From this position, threat actors can attempt lateral movement by exploiting trust relationships between the compromised tenant and partner organizations, or by leveraging guest permissions to access sensitive data that can be used for further credential compromise or business email compromise attacks.
+
+**Remediation action**
+
+- [Configure Domain-Based Allow or Deny Lists](https://learn.microsoft.com/en-us/entra/external-id/allow-deny-list)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21822.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21822.ps1
new file mode 100644
index 000000000000..f9a9e2427c23
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21822.ps1
@@ -0,0 +1,67 @@
+function Invoke-CippTestZTNA21822 {
+    <#
+    .SYNOPSIS
+    Guest access is limited to approved tenants
+    #>
+    param($Tenant)
+    #Tested
+    $TestId = 'ZTNA21822'
+
+    try {
+        # Get B2B management policy from cache
+        $B2BManagementPolicyObject = New-CIPPDbRequest -TenantFilter $Tenant -Type 'B2BManagementPolicy'
+
+        $Passed = 'Failed'
+        $AllowedDomains = @()
+        $BlockedDomains = @()
+
+        if ($B2BManagementPolicyObject -and $B2BManagementPolicyObject.definition) {
+            $B2BManagementPolicy = ($B2BManagementPolicyObject.definition | ConvertFrom-Json).B2BManagementPolicy
+            $AllowedDomains = $B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains
+            $BlockedDomains = $B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.BlockedDomains
+
+            if ($AllowedDomains -and $AllowedDomains.Count -gt 0) {
+                $Passed = 'Passed'
+            }
+        }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "Guest access is limited to approved tenants.`n"
+        } else {
+            $ResultMarkdown = "Guest access is not limited to approved tenants.`n"
+        }
+
+        $ResultMarkdown += "`n`n## [Collaboration restrictions](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings/menuId/)`n`n"
+        $ResultMarkdown += 'The tenant is configured to: '
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown += "**Allow invitations only to the specified domains (most restrictive)** ✅`n"
+        } else {
+            if ($BlockedDomains -and $BlockedDomains.Count -gt 0) {
+                $ResultMarkdown += "**Deny invitations to the specified domains** ❌`n"
+            } else {
+                $ResultMarkdown += "**Allow invitations to be sent to any domain (most inclusive)** ❌`n"
+            }
+        }
+
+        if (($AllowedDomains -and $AllowedDomains.Count -gt 0) -or ($BlockedDomains -and $BlockedDomains.Count -gt 0)) {
+            $ResultMarkdown += "| Domain | Status |`n"
+            $ResultMarkdown += "| :--- | :--- |`n"
+
+            foreach ($Domain in $AllowedDomains) {
+                $ResultMarkdown += "| $Domain | ✅ Allowed |`n"
+            }
+
+            foreach ($Domain in $BlockedDomains) {
+                $ResultMarkdown += "| $Domain | ❌ Blocked |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Access control'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'Access control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21823.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21823.md
new file mode 100644
index 000000000000..577af3c21731
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21823.md
@@ -0,0 +1,10 @@
+When guest self-service sign-up is enabled, threat actors can exploit it to establish unauthorized access by creating legitimate guest accounts without requiring approval from authorized personnel. These accounts can be scoped to specific services to reduce detection and effectively bypass invitation-based controls that validate external user legitimacy.
+
+Once created, self-provisioned guest accounts provide persistent access to organizational resources and applications. Threat actors can use them to conduct reconnaissance activities to map internal systems, identify sensitive data repositories, and plan further attack vectors. This persistence allows adversaries to maintain access across restarts, credential changes, and other interruptions, while the guest account itself offers a seemingly legitimate identity that might evade security monitoring focused on external threats.
+
+Additionally, compromised guest identities can be used to establish credential persistence and potentially escalate privileges. Attackers can exploit trust relationships between guest accounts and internal resources, or use the guest account as a staging ground for lateral movement toward more privileged organizational assets.
+
+**Remediation action**
+- [Configure guest self-service sign-up With Microsoft Entra External ID](https://learn.microsoft.com/en-us/entra/external-id/external-collaboration-settings-configure?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#to-configure-guest-self-service-sign-up)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21823.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21823.ps1
new file mode 100644
index 000000000000..24ddb005d5bb
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21823.ps1
@@ -0,0 +1,34 @@
+function Invoke-CippTestZTNA21823 {
+    <#
+    .SYNOPSIS
+    Guest self-service sign-up via user flow is disabled
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21823'
+    #Tested
+    try {
+        # Get authentication flows policy from cache
+        $AuthFlowPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationFlowsPolicy'
+
+        if (-not $AuthFlowPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Guest self-service sign-up via user flow is disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'External collaboration'
+            return
+        }
+
+        $Passed = if ($AuthFlowPolicy.selfServiceSignUp.isEnabled -eq $false) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "[Guest self-service sign up via user flow](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings/menuId/ExternalIdentitiesGettingStarted) is disabled.`n"
+        } else {
+            $ResultMarkdown = "[Guest self-service sign up via user flow](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/CompanyRelationshipsMenuBlade/~/Settings/menuId/ExternalIdentitiesGettingStarted) is enabled.`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Guest self-service sign-up via user flow is disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'External collaboration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guest self-service sign-up via user flow is disabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'External collaboration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21824.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21824.md
new file mode 100644
index 000000000000..b6f19e7039e7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21824.md
@@ -0,0 +1,12 @@
+Guest accounts with extended sign-in sessions increase the risk surface area that threat actors can exploit. When guest sessions persist beyond necessary timeframes, threat actors often attempt to gain initial access through credential stuffing, password spraying, or social engineering attacks. Once they gain access, they can maintain unauthorized access for extended periods without reauthentication challenges. These compromised and extended sessions:
+
+- Allow unauthorized access to Microsoft Entra artifacts, enabling threat actors to identify sensitive resources and map organizational structures.
+- Allow threat actors to persist within the network by using legitimate authentication tokens, making detection more challenging as the activity appears as typical user behavior.
+- Provides threat actors with a longer window of time to escalate privileges through techniques like accessing shared resources, discovering more credentials, or exploiting trust relationships between systems.
+
+Without proper session controls, threat actors can achieve lateral movement across the organization's infrastructure, accessing critical data and systems that extend far beyond the original guest account's intended scope of access. 
+
+**Remediation action**
+- [Configure adaptive session lifetime policies](https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) so sign-in frequency policies have shorter live sign-in sessions.<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21824.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21824.ps1
new file mode 100644
index 000000000000..a6993c280c02
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21824.ps1
@@ -0,0 +1,86 @@
+function Invoke-CippTestZTNA21824 {
+    <#
+    .SYNOPSIS
+    Guests don't have long lived sign-in sessions
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $allCAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $allCAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21824' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name "Guests don't have long lived sign-in sessions" -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Conditional Access'
+            return
+        }
+
+        $filteredCAPolicies = $allCAPolicies | Where-Object {
+            ($null -ne $_.conditions.users.includeGuestsOrExternalUsers) -and
+            ($_.state -in @('enabled', 'enabledForReportingButNotEnforced')) -and
+            ($null -eq $_.grantControls.termsOfUse -or $_.grantControls.termsOfUse.Count -eq 0)
+        }
+
+        $matchedPolicies = $filteredCAPolicies | Where-Object {
+            $signInFrequency = $_.sessionControls.signInFrequency
+            if ($signInFrequency -and $signInFrequency.isEnabled) {
+                ($signInFrequency.type -eq 'hours' -and $signInFrequency.value -le 24) -or
+                ($signInFrequency.type -eq 'days' -and $signInFrequency.value -eq 1) -or
+                ($null -eq $signInFrequency.type -and $signInFrequency.frequencyInterval -eq 'everyTime')
+            } else {
+                $false
+            }
+        }
+
+        $passed = if ($filteredCAPolicies.Count -eq $matchedPolicies.Count) { 'Passed' } else { 'Failed' }
+
+        if ($passed -eq 'Passed') {
+            $testResultMarkdown = "Guests don't have long lived sign-in sessions."
+        } else {
+            $testResultMarkdown = 'Guests do have long lived sign-in sessions.'
+        }
+
+        $reportTitle = 'Sign-in frequency policies'
+
+        if ($filteredCAPolicies -and $filteredCAPolicies.Count -gt 0) {
+            $mdInfo = "`n## $reportTitle`n`n"
+            $mdInfo += "| Policy Name | Sign-in Frequency | Status |`n"
+            $mdInfo += "| :---------- | :---------------- | :----- |`n"
+
+            foreach ($filteredCAPolicy in $filteredCAPolicies) {
+                $policyName = $filteredCAPolicy.DisplayName
+
+                $signInFrequency = $filteredCAPolicy.sessionControls.signInFrequency
+                switch ($signInFrequency.type) {
+                    'hours' {
+                        $signInFreqValue = "$($signInFrequency.value) hours"
+                    }
+                    'days' {
+                        $signInFreqValue = "$($signInFrequency.value) days"
+                    }
+                    default {
+                        if ($signInFrequency.frequencyInterval -eq 'everyTime') {
+                            $signInFreqValue = 'Every time'
+                        } else {
+                            $signInFreqValue = 'Not configured'
+                        }
+                    }
+                }
+
+                $status = if ($matchedPolicies -and $matchedPolicies.Id -contains $filteredCAPolicy.Id) {
+                    '✅'
+                } else {
+                    '❌'
+                }
+
+                $mdInfo += "| $policyName | $signInFreqValue | $status |`n"
+            }
+
+            $testResultMarkdown = $testResultMarkdown + $mdInfo
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21824' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'Medium' -Name "Guests don't have long lived sign-in sessions" -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Conditional Access'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21824' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name "Guests don't have long lived sign-in sessions" -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Conditional Access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21825.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21825.md
new file mode 100644
index 000000000000..25e38ec74568
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21825.md
@@ -0,0 +1,15 @@
+When privileged users are allowed to maintain long-lived sign-in sessions without periodic reauthentication, threat actors can gain extended windows of opportunity to exploit compromised credentials or hijack active sessions. Once a privileged account is compromised through techniques like credential theft, phishing, or session fixation, extended session timeouts allow threat actors to maintain persistence within the environment for prolonged periods. With long-lived sessions, threat actors can perform lateral movement across systems, escalate privileges further, and access sensitive resources without triggering another authentication challenge. The extended session duration also increases the window for session hijacking attacks, where threat actors can steal session tokens and impersonate the privileged user. Once a threat actor is established in a privileged session, they can:
+
+- Create backdoor accounts
+- Modify security policies
+- Access sensitive data
+- Establish more persistence mechanisms
+
+The lack of periodic reauthentication requirements means that even if the original compromise is detected, the threat actor might continue operating undetected using the hijacked privileged session until the session naturally expires or the user manually signs out.
+
+**Remediation action**
+
+- [Learn about Conditional Access adaptive session lifetime policies](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-session-lifetime?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Configure sign-in frequency for privileged users with Conditional Access policies ](https://learn.microsoft.com/en-us/entra/identity/conditional-access/howto-conditional-access-session-lifetime?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21825.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21825.ps1
new file mode 100644
index 000000000000..2ad49609f454
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21825.ps1
@@ -0,0 +1,107 @@
+function Invoke-CippTestZTNA21825 {
+    <#
+    .SYNOPSIS
+    Privileged users have short-lived sign-in sessions
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21825'
+    #Tested
+    try {
+        # Get privileged roles
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+
+        if (-not $PrivilegedRoles -or $PrivilegedRoles.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Privileged users have short-lived sign-in sessions' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
+            return
+        }
+
+        # Get Conditional Access policies
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        # Filter to policies targeting roles
+        $RoleScopedPolicies = $CAPolicies | Where-Object {
+            $_.conditions.users.includeRoles -and $_.conditions.users.includeRoles.Count -gt 0
+        }
+
+        # Recommended: Sign-in frequency should be 4 hours or less for privileged users
+        $RecommendedMaxHours = 4
+
+        $ResultMarkdown = "## Privileged User Sign-In Sessions`n`n"
+        $ResultMarkdown += "**Total Privileged Roles Found:** $($PrivilegedRoles.Count)`n`n"
+        $ResultMarkdown += "**CA Policies Targeting Roles:** $($RoleScopedPolicies.Count)`n`n"
+        $ResultMarkdown += "**Recommended Sign In Session Hours:** $RecommendedMaxHours`n`n"
+        $ResultMarkdown += "### Conditional Access Policies by Privileged Role`n`n"
+
+        $AllRolesCovered = $true
+
+        foreach ($Role in $PrivilegedRoles) {
+            $ResultMarkdown += "#### $($Role.displayName)`n`n"
+
+            # Get CA policies assigned to this role
+            $AssignedPolicies = $CAPolicies | Where-Object { $_.conditions.users.includeRoles -contains $Role.id }
+            $EnabledPolicies = $AssignedPolicies | Where-Object { $_.state -eq 'enabled' }
+
+            if ($EnabledPolicies.Count -gt 0) {
+                # Check if at least one compliant enabled policy covers this role
+                $CompliantForRole = $EnabledPolicies | Where-Object {
+                    $_.sessionControls.signInFrequency -and
+                    $_.sessionControls.signInFrequency.type -eq 'hours' -and
+                    $_.sessionControls.signInFrequency.value -le $RecommendedMaxHours
+                }
+
+                $RoleStatus = if ($CompliantForRole.Count -gt 0) {
+                    '✅ Covered'
+                } else {
+                    '❌ Not Covered'; $AllRolesCovered = $false
+                }
+                $ResultMarkdown += "**Status:** $RoleStatus`n`n"
+
+                $ResultMarkdown += "| Policy Name | Sign-In Frequency | Compliant |`n"
+                $ResultMarkdown += "| :--- | :--- | :--- |`n"
+
+                foreach ($Policy in $EnabledPolicies) {
+                    $FreqValue = 'Not Configured'
+                    $IsCompliant = '❌'
+
+                    if ($Policy.sessionControls.signInFrequency) {
+                        $Freq = $Policy.sessionControls.signInFrequency
+                        $FreqValue = "$($Freq.value) $($Freq.type)"
+
+                        if ($Freq.type -eq 'hours' -and $Freq.value -le $RecommendedMaxHours) {
+                            $IsCompliant = '✅'
+                        } elseif ($Freq.type -eq 'hours') {
+                            $IsCompliant = "⚠️ ($($Freq.value)h > $($RecommendedMaxHours)h)"
+                        } else {
+                            $IsCompliant = '❌ (Days not recommended)'
+                        }
+                    }
+
+                    $PolicyLink = "https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($Policy.id)"
+                    $ResultMarkdown += "| [$($Policy.displayName)]($PolicyLink) | $FreqValue | $IsCompliant |`n"
+                }
+                $ResultMarkdown += "`n"
+            } else {
+                $ResultMarkdown += "**Status:** ❌ No CA policies assigned`n`n"
+                $ResultMarkdown += "*No Conditional Access policies target this privileged role.*`n`n"
+                $AllRolesCovered = $false
+            }
+        }
+
+        $Passed = if ($AllRolesCovered -and $PrivilegedRoles.Count -gt 0) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown += "✅ **All privileged roles are covered by enabled policies enforcing short-lived sessions (≤$RecommendedMaxHours hours).**`n"
+        } else {
+            $ResultMarkdown += "❌ **Not all privileged roles are covered by compliant sign-in frequency controls.**`n"
+            $ResultMarkdown += "`n**Recommendation:** Configure Conditional Access policies to enforce sign-in frequency of $RecommendedMaxHours hours or less for ALL privileged roles.`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Privileged users have short-lived sign-in sessions' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Privileged users have short-lived sign-in sessions' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21828.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21828.md
new file mode 100644
index 000000000000..5f23b96e0682
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21828.md
@@ -0,0 +1,8 @@
+Blocking authentication transfer in Microsoft Entra ID is a critical security control. It helps protect against token theft and replay attacks by preventing the use of device tokens to silently authenticate on other devices or browsers. When authentication transfer is enabled, a threat actor who gains access to one device can access resources to nonapproved devices, bypassing standard authentication and device compliance checks. When administrators block this flow, organizations can ensure that each authentication request must originate from the original device, maintaining the integrity of the device compliance and user session context.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to block authentication transfer](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-authentication-flows?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#authentication-transfer-policies)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21828.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21828.ps1
new file mode 100644
index 000000000000..8fa1c672570e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21828.ps1
@@ -0,0 +1,56 @@
+function Invoke-CippTestZTNA21828 {
+    <#
+    .SYNOPSIS
+    Authentication transfer is blocked
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $allCAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $allCAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21828' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Authentication transfer is blocked' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Conditional Access'
+            return
+        }
+
+        $matchedPolicies = $allCAPolicies | Where-Object {
+            $_.conditions.authenticationFlows.transferMethods -match 'authenticationTransfer' -and
+            $_.grantControls.builtInControls -contains 'block' -and
+            $_.conditions.users.includeUsers -eq 'all' -and
+            $_.conditions.applications.includeApplications -eq 'all' -and
+            $_.state -eq 'enabled'
+        }
+
+        if ($matchedPolicies.Count -gt 0) {
+            $passed = 'Passed'
+            $testResultMarkdown = 'Authentication transfer is blocked by Conditional Access Policy(s).'
+        } else {
+            $passed = 'Failed'
+            $testResultMarkdown = 'Authentication transfer is not blocked.'
+        }
+
+        $reportTitle = 'Conditional Access Policies targeting Authentication Transfer'
+
+        if ($matchedPolicies.Count -gt 0) {
+            $mdInfo = "`n## $reportTitle`n`n"
+            $mdInfo += "| Policy Name | Policy ID | State | Created | Modified |`n"
+            $mdInfo += "| :---------- | :-------- | :---- | :------ | :------- |`n"
+
+            foreach ($policy in $matchedPolicies) {
+                $created = if ($policy.createdDateTime) { $policy.createdDateTime } else { 'N/A' }
+                $modified = if ($policy.modifiedDateTime) { $policy.modifiedDateTime } else { 'N/A' }
+                $mdInfo += "| $($policy.displayName) | $($policy.id) | $($policy.state) | $created | $modified |`n"
+            }
+
+            $testResultMarkdown = $testResultMarkdown + $mdInfo
+        } else {
+            $testResultMarkdown = $testResultMarkdown + "`n`nNo Conditional Access policies targeting authentication transfer."
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21828' -TestType 'Identity' -Status $passed -ResultMarkdown $testResultMarkdown -Risk 'High' -Name 'Authentication transfer is blocked' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Conditional Access'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21828' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Authentication transfer is blocked' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Conditional Access'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21829.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21829.md
new file mode 100644
index 000000000000..470f74876eea
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21829.md
@@ -0,0 +1,8 @@
+An on-premises federation server introduces a critical attack surface by serving as a central authentication point for cloud applications. Threat actors often gain a foothold by compromising a privileged user such as a help desk representative or an operations engineer through attacks like phishing, credential stuffing, or exploiting weak passwords. They might also target unpatched vulnerabilities in infrastructure, use remote code execution exploits, attack the Kerberos protocol, or use pass-the-hash attacks to escalate privileges. Misconfigured remote access tools like remote desktop protocol (RDP), virtual private network (VPN), or jump servers provide other entry points, while supply chain compromises or malicious insiders further increase exposure. Once inside, threat actors can manipulate authentication flows, forge security tokens to impersonate any user, and pivot into cloud environments. Establishing persistence, they can disable security logs, evade detection, and exfiltrate sensitive data.
+
+**Remediation action**
+
+- [Migrate from federation to cloud authentication like Microsoft Entra Password hash synchronization (PHS)](https://learn.microsoft.com/entra/identity/hybrid/connect/migrate-from-federation-to-cloud-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21829.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21829.ps1
new file mode 100644
index 000000000000..6dcd4437bd47
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21829.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestZTNA21829 {
+    <#
+    .SYNOPSIS
+    Use cloud authentication
+    #>
+    param($Tenant)
+    #Tested
+    $TestId = 'ZTNA21829'
+
+    try {
+        # Get domains
+        $Domains = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Domains'
+
+        if (-not $Domains) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Use cloud authentication' -UserImpact 'High' -ImplementationEffort 'High' -Category 'Access control'
+            return
+        }
+
+        $FederatedDomains = $Domains | Where-Object { $_.authenticationType -eq 'Federated' }
+        $Passed = if ($FederatedDomains.Count -eq 0) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "All domains are using cloud authentication.`n`n"
+        } else {
+            $ResultMarkdown = "Federated authentication is in use.`n`n"
+
+            $ResultMarkdown += "`n## List of federated domains`n`n"
+            $ResultMarkdown += "| Domain Name |`n"
+            $ResultMarkdown += "| :--- |`n"
+            foreach ($Domain in $FederatedDomains) {
+                $ResultMarkdown += "| $($Domain.id) |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Use cloud authentication' -UserImpact 'High' -ImplementationEffort 'High' -Category 'Access control'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Use cloud authentication' -UserImpact 'High' -ImplementationEffort 'High' -Category 'Access control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21830.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21830.md
new file mode 100644
index 000000000000..790102b27622
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21830.md
@@ -0,0 +1,11 @@
+If privileged role activations aren't restricted to dedicated Privileged Access Workstations (PAWs), threat actors can exploit compromised endpoint devices to perform privileged escalation attacks from unmanaged or noncompliant workstations. Standard productivity workstations often contain attack vectors such as unrestricted web browsing, email clients vulnerable to phishing, and locally installed applications with potential vulnerabilities. When administrators activated privileged roles from these workstations, threat actors who gain initial access through malware, browser exploits, or social engineering can then use the locally cached privileged credentials or hijack existing authenticated sessions to escalate their privileges. Privileged role activations grant extensive administrative rights across Microsoft Entra ID and connected services, so attackers can create new administrative accounts, modify security policies, access sensitive data across all organizational resources, and deploy malware or backdoors throughout the environment to establish persistent access. This lateral movement from a compromised endpoint to privileged cloud resources represents a critical attack path that bypasses many traditional security controls. The privileged access appears legitimate when originating from an authenticated administrator's session.
+
+If this check passes, your tenant has a Conditional Access policy that restricts privileged role access to PAW devices, but it isn't the only control required to fully enable a PAW solution. You also need to configure an Intune device configuration and compliance policy and a device filter.
+
+**Remediation action**
+
+- [Deploy a privileged access workstation solution](https://learn.microsoft.com/security/privileged-access-workstations/privileged-access-deployment?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+    - Provides guidance for configuring the Conditional Access and Intune device configuration and compliance policies.
+- [Configure device filters in Conditional Access to restrict privileged access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21830.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21830.ps1
new file mode 100644
index 000000000000..8dd9f35942b8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21830.ps1
@@ -0,0 +1,86 @@
+function Invoke-CippTestZTNA21830 {
+    <#
+    .SYNOPSIS
+    Conditional Access policies for Privileged Access Workstations are configured
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21830'
+    #Tested
+    try {
+        # Get Conditional Access policies
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+        $EnabledCAPolicies = $CAPolicies | Where-Object { $_.state -eq 'enabled' }
+
+        # Get privileged roles
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+
+        if (-not $PrivilegedRoles) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Conditional Access policies for Privileged Access Workstations are configured' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+            return
+        }
+
+        $CompliantDevicePolicies = [System.Collections.Generic.List[object]]::new()
+        $DeviceFilterPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Policy in $EnabledCAPolicies) {
+            # Check if policy targets privileged roles
+            $TargetsPrivilegedRoles = $false
+            if ($Policy.conditions.users.includeRoles) {
+                foreach ($RoleId in $Policy.conditions.users.includeRoles) {
+                    if ($PrivilegedRoles.id -contains $RoleId) {
+                        $TargetsPrivilegedRoles = $true
+                        break
+                    }
+                }
+            }
+
+            if ($TargetsPrivilegedRoles) {
+                # Check for compliant device control
+                if ($Policy.grantControls.builtInControls -contains 'compliantDevice') {
+                    $CompliantDevicePolicies.Add($Policy)
+                }
+
+                # Check for device filter exclude + block
+                $HasDeviceFilterExclude = $Policy.conditions.devices.deviceFilter -and
+                $Policy.conditions.devices.deviceFilter.mode -eq 'exclude'
+                $BlocksAccess = (-not $Policy.grantControls.builtInControls) -or
+                ($Policy.grantControls.builtInControls -contains 'block')
+
+                if ($HasDeviceFilterExclude -and $BlocksAccess) {
+                    $DeviceFilterPolicies.Add($Policy)
+                }
+            }
+        }
+
+        $Passed = if ($CompliantDevicePolicies.Count -eq 0 -or $DeviceFilterPolicies.Count -eq 0) { 'Failed' } else { 'Passed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = 'Conditional Access policies restrict privileged role access to PAW devices.'
+        } else {
+            $ResultMarkdown = 'No Conditional Access policies found that restrict privileged roles to PAW device.'
+        }
+
+        $CompliantDeviceMarkdown = if ($CompliantDevicePolicies.Count -gt 0) { '✅' } else { '❌' }
+        $DeviceFilterMarkdown = if ($DeviceFilterPolicies.Count -gt 0) { '✅' } else { '❌' }
+
+        $ResultMarkdown += "`n`n**$CompliantDeviceMarkdown Found $($CompliantDevicePolicies.Count) policy(s) with compliant device control targeting all privileged roles**`n"
+        foreach ($Policy in $CompliantDevicePolicies) {
+            $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($Policy.id)"
+            $ResultMarkdown += "- **Policy:** [$($Policy.displayName)]($PortalLink)`n"
+        }
+
+        $ResultMarkdown += "`n`n**$DeviceFilterMarkdown Found $($DeviceFilterPolicies.Count) policy(s) with PAW/SAW device filter targeting all privileged roles**`n"
+        foreach ($Policy in $DeviceFilterPolicies) {
+            $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($Policy.id)"
+            $ResultMarkdown += "- **Policy:** [$($Policy.displayName)]($PortalLink)`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Conditional Access policies for Privileged Access Workstations are configured' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Conditional Access policies for Privileged Access Workstations are configured' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21831.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21831.md
new file mode 100644
index 000000000000..abcf2871d752
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21831.md
@@ -0,0 +1,10 @@
+Threat actors who gain privileged access to a tenant can manipulate identity, access, and security configurations. This type of attack can result in environment-wide compromise and loss of control over organizational assets. Take action to protect high-impact management tasks associated with Conditional Access policies, cross-tenant access settings, hard deletions, and network locations that are critical to maintaining security.
+
+Protected actions let administrators secure these tasks with extra security controls, such as stronger authentication methods (passwordless MFA or phishing-resistant MFA), the use of Privileged Access Workstation (PAW) devices, or shorter session timeouts.
+
+**Remediation action**
+
+- [Add, test, or remove protected actions in Microsoft Entra ID](https://learn.microsoft.com/entra/identity/role-based-access-control/protected-actions-add?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21832.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21832.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21832.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21833.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21833.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21833.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21834.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21834.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21834.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.md
new file mode 100644
index 000000000000..be68f5749ef6
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.md
@@ -0,0 +1,8 @@
+Microsoft recommends that organizations have two cloud-only emergency access accounts permanently assigned the [Global Administrator](https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#global-administrator) role. These accounts are highly privileged and aren't assigned to specific individuals. The accounts are limited to emergency or "break glass" scenarios where normal accounts can't be used or all other administrators are accidentally locked out.
+
+**Remediation action**
+
+- Create accounts following the [emergency access account recommendations](https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1
new file mode 100644
index 000000000000..f9f7e021dd98
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21835.ps1
@@ -0,0 +1,205 @@
+function Invoke-CippTestZTNA21835 {
+    <#
+    .SYNOPSIS
+    Emergency access accounts are configured appropriately
+    #>
+    param($Tenant)
+    #Untested
+    $TestId = 'ZTNA21835'
+
+    try {
+        # Get Global Administrator role (template ID: 62e90394-69f5-4237-9190-012177145e10)
+        $Roles = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Roles'
+        $GlobalAdminRole = $Roles | Where-Object { $_.roleTemplateId -eq '62e90394-69f5-4237-9190-012177145e10' }
+
+        if (-not $GlobalAdminRole) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Emergency access accounts are configured appropriately' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+            return
+        }
+
+        # Get permanent Global Administrator members
+        $PermanentGAMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleTemplateId '62e90394-69f5-4237-9190-012177145e10' | Where-Object {
+            $_.AssignmentType -eq 'Permanent' -and $_.'@odata.type' -eq '#microsoft.graph.user'
+        }
+
+        # Get Users data to check sync status
+        $Users = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users'
+
+        $EmergencyAccountCandidates = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Member in $PermanentGAMembers) {
+            $User = $Users | Where-Object { $_.id -eq $Member.principalId }
+
+            # Only process cloud-only accounts
+            if ($User -and $User.onPremisesSyncEnabled -ne $true) {
+                # Note: Individual user authentication methods require per-user API calls not available in cache
+                # Add all cloud-only permanent GAs as candidates (cannot verify auth methods from cache)
+                $EmergencyAccountCandidates.Add([PSCustomObject]@{
+                        Id                    = $User.id
+                        UserPrincipalName     = $User.userPrincipalName
+                        DisplayName           = $User.displayName
+                        OnPremisesSyncEnabled = $User.onPremisesSyncEnabled
+                        AuthenticationMethods = @('Unknown - requires per-user API call')
+                        CAPoliciesTargeting   = 0
+                        ExcludedFromAllCA     = $false
+                    })
+            }
+        }
+
+        # Get CA policies
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+        $EnabledCAPolicies = $CAPolicies | Where-Object { $_.state -eq 'enabled' }
+
+        $EmergencyAccessAccounts = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Candidate in $EmergencyAccountCandidates) {
+            # Note: Transitive group and role memberships require per-user API calls not available in cache
+            # Simplified check: only verify direct includes/excludes in CA policies
+            $UserGroupIds = @()
+            $UserRoles = @()
+            $UserRoleIds = @()
+
+            $PoliciesTargetingUser = 0
+            $ExcludedFromAll = $true
+
+            foreach ($Policy in $EnabledCAPolicies) {
+                $IsTargeted = $false
+
+                # Check user includes/excludes
+                $IncludeUsers = @($Policy.conditions.users.includeUsers)
+                $ExcludeUsers = @($Policy.conditions.users.excludeUsers)
+
+                if ($IncludeUsers -contains 'All' -or $IncludeUsers -contains $Candidate.Id) {
+                    $IsTargeted = $true
+                }
+
+                if ($ExcludeUsers -contains $Candidate.Id) {
+                    $IsTargeted = $false
+                }
+
+                # Check group includes/excludes
+                if (-not $IsTargeted -and $UserGroupIds.Count -gt 0) {
+                    $IncludeGroups = @($Policy.conditions.users.includeGroups)
+                    $ExcludeGroups = @($Policy.conditions.users.excludeGroups)
+
+                    foreach ($GroupId in $UserGroupIds) {
+                        if ($IncludeGroups -contains $GroupId) {
+                            $IsTargeted = $true
+                        }
+                        if ($ExcludeGroups -contains $GroupId) {
+                            $IsTargeted = $false
+                            break
+                        }
+                    }
+                }
+
+                # Check role includes/excludes
+                $IncludeRoles = @($Policy.conditions.users.includeRoles)
+                $ExcludeRoles = @($Policy.conditions.users.excludeRoles)
+
+                foreach ($RoleId in $UserRoleIds) {
+                    $Role = $UserRoles | Where-Object { $_.id -eq $RoleId }
+                    if ($Role -and $IncludeRoles -contains $Role.roleTemplateId) {
+                        $IsTargeted = $true
+                    }
+                    if ($Role -and $ExcludeRoles -contains $Role.roleTemplateId) {
+                        $IsTargeted = $false
+                        break
+                    }
+                }
+
+                if ($IsTargeted) {
+                    $PoliciesTargetingUser++
+                    $ExcludedFromAll = $false
+                }
+            }
+
+            $Candidate.CAPoliciesTargeting = $PoliciesTargetingUser
+            $Candidate.ExcludedFromAllCA = $ExcludedFromAll
+
+            if ($ExcludedFromAll) {
+                $EmergencyAccessAccounts.Add($Candidate)
+            }
+        }
+
+        $AccountCount = $EmergencyAccessAccounts.Count
+        $Passed = 'Failed'
+        $ResultMarkdown = ''
+
+        if ($AccountCount -lt 2) {
+            $ResultMarkdown = "Fewer than two emergency access accounts were identified based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions.`n`n"
+        } elseif ($AccountCount -ge 2 -and $AccountCount -le 4) {
+            $Passed = 'Passed'
+            $ResultMarkdown = "Emergency access accounts appear to be configured as per Microsoft guidance based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions.`n`n"
+        } else {
+            $ResultMarkdown = "$AccountCount emergency access accounts appear to be configured based on cloud-only state, registered phishing-resistant credentials and Conditional Access policy exclusions. Review these accounts to determine whether this volume is excessive for your organization.`n`n"
+        }
+
+        $ResultMarkdown += "**Summary:**`n"
+        $ResultMarkdown += "- Total permanent Global Administrators: $($PermanentGAMembers.Count)`n"
+        $ResultMarkdown += "- Cloud-only GAs with phishing-resistant auth: $($EmergencyAccountCandidates.Count)`n"
+        $ResultMarkdown += "- Emergency access accounts (excluded from all CA): $AccountCount`n"
+        $ResultMarkdown += "- Enabled Conditional Access policies: $($EnabledCAPolicies.Count)`n`n"
+
+        if ($EmergencyAccessAccounts.Count -gt 0) {
+            $ResultMarkdown += "## Emergency access accounts`n`n"
+            $ResultMarkdown += "| Display name | UPN | Synced from on-premises | Authentication methods |`n"
+            $ResultMarkdown += "| :----------- | :-- | :---------------------- | :--------------------- |`n"
+
+            foreach ($Account in $EmergencyAccessAccounts) {
+                $SyncStatus = if ($Account.OnPremisesSyncEnabled -ne $true) { 'No' } else { 'Yes' }
+                $AuthMethodDisplay = ($Account.AuthenticationMethods | ForEach-Object {
+                        $_ -replace '#microsoft.graph.', '' -replace 'AuthenticationMethod', ''
+                    }) -join ', '
+
+                $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/$($Account.Id)"
+                $ResultMarkdown += "| $($Account.DisplayName) | [$($Account.UserPrincipalName)]($PortalLink) | $SyncStatus | $AuthMethodDisplay |`n"
+            }
+            $ResultMarkdown += "`n"
+        }
+
+        if ($PermanentGAMembers.Count -gt 0) {
+            $ResultMarkdown += "## All permanent Global Administrators`n`n"
+            $ResultMarkdown += "| Display name | UPN | Cloud only | All CA excluded | Phishing resistant auth |`n"
+            $ResultMarkdown += "| :----------- | :-- | :--------: | :---------: | :---------------------: |`n"
+
+            $UserSummary = [System.Collections.Generic.List[object]]::new()
+            foreach ($Member in $PermanentGAMembers) {
+                $User = $Users | Where-Object { $_.id -eq $Member.principalId }
+                if (-not $User) { continue }
+
+                $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/$($User.id)"
+                $IsCloudOnly = ($User.onPremisesSyncEnabled -ne $true)
+                $CloudOnlyEmoji = if ($IsCloudOnly) { '✅' } else { '❌' }
+
+                $EmergencyAccount = $EmergencyAccessAccounts | Where-Object { $_.Id -eq $User.id }
+                $CAExcludedEmoji = if ($EmergencyAccount) { '✅' } else { '❌' }
+
+                $Candidate = $EmergencyAccountCandidates | Where-Object { $_.Id -eq $User.id }
+                $PhishingResistantEmoji = if ($Candidate) { '✅' } else { '❌' }
+
+                $UserSummary.Add([PSCustomObject]@{
+                        DisplayName       = $User.displayName
+                        UserPrincipalName = $User.userPrincipalName
+                        PortalLink        = $PortalLink
+                        CloudOnly         = $CloudOnlyEmoji
+                        CAExcluded        = $CAExcludedEmoji
+                        PhishingResistant = $PhishingResistantEmoji
+                    })
+            }
+
+            foreach ($UserSum in $UserSummary) {
+                $ResultMarkdown += "| $($UserSum.DisplayName) | [$($UserSum.UserPrincipalName)]($($UserSum.PortalLink)) | $($UserSum.CloudOnly) | $($UserSum.CAExcluded) | $($UserSum.PhishingResistant) |`n"
+            }
+
+            $ResultMarkdown += "`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Emergency access accounts are configured appropriately' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Emergency access accounts are configured appropriately' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.md
new file mode 100644
index 000000000000..08ff6ceb70f4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.md
@@ -0,0 +1,8 @@
+If administrators assign privileged roles to workload identities, such as service principals or managed identities, the tenant can be exposed to significant risk if those identities are compromised. Threat actors who gain access to a privileged workload identity can perform reconnaissance to enumerate resources, escalate privileges, and manipulate or exfiltrate sensitive data. The attack chain typically begins with credential theft or abuse of a vulnerable application. Next step is privilege escalation through the assigned role, lateral movement across cloud resources, and finally persistence via other role assignments or credential updates. Workload identities are often used in automation and might not be monitored as closely as user accounts. Compromise can then go undetected, allowing threat actors to maintain access and control over critical resources. Workload identities aren't subject to user-centric protections like MFA, making least-privilege assignment and regular review essential. 
+
+**Remediation action**
+- [Review and remove privileged roles assignments](https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles-assign-roles?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#update-or-remove-an-existing-role-assignment).
+- [Follow the best practices for workload identities](https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#key-scenarios).
+- [Learn about privileged roles and permissions in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/privileged-roles-permissions?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1
new file mode 100644
index 000000000000..e6129bd4a135
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21836.ps1
@@ -0,0 +1,67 @@
+function Invoke-CippTestZTNA21836 {
+    <#
+    .SYNOPSIS
+    Workload Identities are not assigned privileged roles
+    #>
+    param($Tenant)
+    #Untested
+    $TestId = 'ZTNA21836'
+
+    try {
+        # Get privileged roles
+        $PrivilegedRoles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles
+
+        if (-not $PrivilegedRoles) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Workload Identities are not assigned privileged roles' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
+            return
+        }
+
+        # Get workload identities (service principals) with privileged role assignments
+        $WorkloadIdentitiesWithPrivilegedRoles = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($Role in $PrivilegedRoles) {
+            $RoleMembers = Get-CippDbRoleMembers -TenantFilter $Tenant -RoleId $Role.id
+
+            foreach ($Member in $RoleMembers) {
+                if ($Member.'@odata.type' -eq '#microsoft.graph.servicePrincipal') {
+                    $WorkloadIdentitiesWithPrivilegedRoles.Add([PSCustomObject]@{
+                            PrincipalId          = $Member.principalId
+                            PrincipalDisplayName = $Member.principalDisplayName
+                            AppId                = $Member.appId
+                            RoleDisplayName      = $Role.displayName
+                            RoleDefinitionId     = $Role.id
+                            AssignmentType       = $Member.AssignmentType
+                        })
+                }
+            }
+        }
+
+        $Passed = 'Passed'
+        $ResultMarkdown = ''
+
+        if ($WorkloadIdentitiesWithPrivilegedRoles.Count -gt 0) {
+            $Passed = 'Failed'
+            $ResultMarkdown = "**Found workload identities assigned to privileged roles.**`n"
+            $ResultMarkdown += "| Service Principal Name | Privileged Role | Assignment Type |`n"
+            $ResultMarkdown += "| :--- | :--- | :--- |`n"
+
+            $SortedAssignments = $WorkloadIdentitiesWithPrivilegedRoles | Sort-Object -Property PrincipalDisplayName
+
+            foreach ($Assignment in $SortedAssignments) {
+                $SPLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/$($Assignment.PrincipalId)/appId/$($Assignment.AppId)/preferredSingleSignOnMode~/null/servicePrincipalType/Application/fromNav/"
+                $ResultMarkdown += "| [$($Assignment.PrincipalDisplayName)]($SPLink) | $($Assignment.RoleDisplayName) | $($Assignment.AssignmentType) |`n"
+            }
+            $ResultMarkdown += "`n"
+            $ResultMarkdown += "`n**Recommendation:** Review and remove privileged role assignments from workload identities unless absolutely necessary. Use least-privilege principles and consider alternative approaches like managed identities with specific API permissions instead of directory roles.`n"
+        } else {
+            $ResultMarkdown = "✅ **No workload identities found with privileged role assignments.**`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Workload Identities are not assigned privileged roles' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Workload Identities are not assigned privileged roles' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21837.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21837.md
new file mode 100644
index 000000000000..c97fc5a08508
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21837.md
@@ -0,0 +1,8 @@
+Controlling device proliferation is important. Set a reasonable limit on the number of devices each user can register in your Microsoft Entra ID tenant. Limiting device registration maintains security while allowing business flexibility. Microsoft Entra ID lets users register up to 50 devices by default. Reducing this number to 10 minimizes the attack surface and simplifies device management.
+
+**Remediation action**
+
+- Learn how to [limit the maximum number of devices per user](https://learn.microsoft.com/entra/identity/devices/manage-device-identities?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#configure-device-settings).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21837.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21837.ps1
new file mode 100644
index 000000000000..e42e48ac94d2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21837.ps1
@@ -0,0 +1,46 @@
+function Invoke-CippTestZTNA21837 {
+    <#
+    .SYNOPSIS
+    Limit the maximum number of devices per user to 10
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21837'
+    #Tested
+    try {
+        # Get device registration policy
+        $DeviceSettings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DeviceRegistrationPolicy'
+
+        if (-not $DeviceSettings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Limit the maximum number of devices per user to 10' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Devices'
+            return
+        }
+
+        $UserQuota = $DeviceSettings.userDeviceQuota
+        $EntraDeviceSettingsLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/Overview'
+
+        $Passed = 'Failed'
+        $CustomStatus = $null
+
+        if ($null -eq $UserQuota -or $UserQuota -le 10) {
+            $Passed = 'Passed'
+            $ResultMarkdown = "[Maximum number of devices per user]($EntraDeviceSettingsLink) is set to $UserQuota"
+        } elseif ($UserQuota -gt 10 -and $UserQuota -le 20) {
+            $CustomStatus = 'Investigate'
+            $ResultMarkdown = "[Maximum number of devices per user]($EntraDeviceSettingsLink) is set to $UserQuota. Consider reducing to 10 or fewer."
+        } else {
+            $ResultMarkdown = "[Maximum number of devices per user]($EntraDeviceSettingsLink) is set to $UserQuota. Consider reducing to 10 or fewer."
+        }
+
+        if ($CustomStatus) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $CustomStatus -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Limit the maximum number of devices per user to 10' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Devices'
+        } else {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Limit the maximum number of devices per user to 10' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Devices'
+        }
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Limit the maximum number of devices per user to 10' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Devices'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21838.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21838.md
new file mode 100644
index 000000000000..966d20d34799
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21838.md
@@ -0,0 +1,10 @@
+Enabling the security key authentication method in Microsoft Entra ID mitigates the risk of credential theft and unauthorized access by requiring hardware-backed, phishing-resistant authentication. If this best practice is not followed, threat actors can exploit weak or reused passwords, perform credential stuffing attacks, and escalate privileges through compromised accounts. The kill chain begins with reconnaissance where attackers gather information about user accounts, followed by credential harvesting through various techniques like social engineering or data breaches. Attackers then gain initial access using stolen credentials, move laterally within the network by exploiting trust relationships, and establish persistence to maintain long-term access. Without hardware-backed authentication like FIDO2 security keys, attackers can bypass basic password defenses and multi-factor authentication, increasing the likelihood of data exfiltration and business disruption. Security keys provide cryptographic proof of identity that is bound to the specific device and cannot be replicated or phished, effectively breaking the attack chain at the initial access stage. 
+
+**Remediation action**
+
+* [Enable passkey (FIDO2) authentication method](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2#enable-passkey-fido2-authentication-method)
+
+* [Authentication method policy management](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21838.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21838.ps1
new file mode 100644
index 000000000000..87bc89f02394
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21838.ps1
@@ -0,0 +1,61 @@
+function Invoke-CippTestZTNA21838 {
+    <#
+    .SYNOPSIS
+    Security key authentication method enabled
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21838'
+    #Tested
+    try {
+        # Get FIDO2 authentication method policy
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Security key authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Security key authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
+            return
+        }
+
+        $Fido2Enabled = $Fido2Config.state -eq 'enabled'
+        $Passed = if ($Fido2Enabled) { 'Passed' } else { 'Failed' }
+        $StatusEmoji = if ($Fido2Enabled) { '✅' } else { '❌' }
+
+        if ($Fido2Enabled) {
+            $ResultMarkdown = "Security key authentication method is enabled for your tenant, providing hardware-backed phishing-resistant authentication.`n`n"
+        } else {
+            $ResultMarkdown = "Security key authentication method is not enabled; users cannot register FIDO2 security keys for strong authentication.`n`n"
+        }
+
+        $ResultMarkdown += "## FIDO2 security key authentication settings`n`n"
+        $ResultMarkdown += "$StatusEmoji **FIDO2 authentication method**`n"
+        $ResultMarkdown += "- Status: $($Fido2Config.state)`n"
+
+        $IncludeTargetsDisplay = if ($Fido2Config.includeTargets -and $Fido2Config.includeTargets.Count -gt 0) {
+            ($Fido2Config.includeTargets | ForEach-Object { if ($_.id -eq 'all_users') { 'All users' } else { $_.id } }) -join ', '
+        } else {
+            'None'
+        }
+        $ResultMarkdown += "- Include targets: $IncludeTargetsDisplay`n"
+
+        $ExcludeTargetsDisplay = if ($Fido2Config.excludeTargets -and $Fido2Config.excludeTargets.Count -gt 0) {
+            ($Fido2Config.excludeTargets | ForEach-Object { $_.id }) -join ', '
+        } else {
+            'None'
+        }
+        $ResultMarkdown += "- Exclude targets: $ExcludeTargetsDisplay`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Security key authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Security key authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21839.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21839.md
new file mode 100644
index 000000000000..036e0c9d2b1b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21839.md
@@ -0,0 +1,11 @@
+When passkey authentication isn't enabled in Microsoft Entra ID, organizations rely on password-based authentication methods that are vulnerable to phishing, credential theft, and replay attacks. Attackers can use stolen passwords to gain initial access, bypass traditional multifactor authentication through Adversary-in-the-Middle (AiTM) attacks, and establish persistent access through token theft.
+
+Passkeys provide phishing-resistant authentication using cryptographic proof that attackers can't phish, intercept, or replay. Enabling passkeys eliminates the foundational vulnerability that enables credential-based attack chains.
+
+**Remediation action**
+
+- Learn how to [enable the passkey authentication method](https://learn.microsoft.com/entra/identity/authentication/how-to-enable-passkey-fido2?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-passkey-fido2-authentication-method).
+- Learn how to [plan a phishing-resistant passwordless authentication deployment](https://learn.microsoft.com/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21839.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21839.ps1
new file mode 100644
index 000000000000..743461e1ff9e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21839.ps1
@@ -0,0 +1,84 @@
+function Invoke-CippTestZTNA21839 {
+    <#
+    .SYNOPSIS
+    Passkey authentication method enabled
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21839'
+    #Tested
+    try {
+        # Get FIDO2 authentication method policy
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Passkey authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Credential management'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Passkey authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Credential management'
+            return
+        }
+
+        $State = $Fido2Config.state
+        $IncludeTargets = $Fido2Config.includeTargets
+        $IsAttestationEnforced = $Fido2Config.isAttestationEnforced
+        $KeyRestrictions = $Fido2Config.keyRestrictions
+
+        $Fido2Enabled = $State -eq 'enabled'
+        $HasIncludeTargets = $IncludeTargets -and $IncludeTargets.Count -gt 0
+
+        $PortalLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods'
+
+        $ResultMarkdown = "`n## [Passkey authentication method details]($PortalLink)`n"
+
+        $StatusDisplay = if ($Fido2Enabled) { 'Enabled ✅' } else { 'Disabled ❌' }
+        $ResultMarkdown += "- **Status** : $StatusDisplay`n"
+
+        if ($Fido2Enabled) {
+            $ResultMarkdown += '- **Include targets** : '
+            if ($IncludeTargets) {
+                $TargetsDisplay = ($IncludeTargets | ForEach-Object {
+                        if ($_.id -eq 'all_users') { 'All users' } else { $_.id }
+                    }) -join ', '
+                $ResultMarkdown += "$TargetsDisplay`n"
+            } else {
+                $ResultMarkdown += "None`n"
+            }
+
+            $ResultMarkdown += "- **Enforce attestation** : $IsAttestationEnforced`n"
+
+            if ($KeyRestrictions) {
+                $ResultMarkdown += "- **Key restriction policy** :`n"
+                if ($null -ne $KeyRestrictions.isEnforced) {
+                    $ResultMarkdown += "  - **Enforce key restrictions** : $($KeyRestrictions.isEnforced)`n"
+                } else {
+                    $ResultMarkdown += "  - **Enforce key restrictions** : Not configured`n"
+                }
+                if ($KeyRestrictions.enforcementType) {
+                    $ResultMarkdown += "  - **Restrict specific keys** : $($KeyRestrictions.enforcementType)`n"
+                } else {
+                    $ResultMarkdown += "  - **Restrict specific keys** : Not configured`n"
+                }
+            }
+        }
+
+        $Passed = if ($Fido2Enabled -and $HasIncludeTargets) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "Passkey authentication method is enabled and configured for users in your tenant.$ResultMarkdown"
+        } else {
+            $ResultMarkdown = "Passkey authentication method is not enabled or not configured for any users in your tenant.$ResultMarkdown"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Passkey authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Passkey authentication method enabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21840.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21840.md
new file mode 100644
index 000000000000..b83dff41f9dc
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21840.md
@@ -0,0 +1,9 @@
+When security key attestation isn't enforced, threat actors can exploit weak or compromised authentication hardware to establish persistent presence within organizational environments. Without attestation validation, malicious actors can register unauthorized or counterfeit FIDO2 security keys that bypass hardware-backed security controls, enabling them to perform credential stuffing attacks using fabricated authenticators that mimic legitimate security keys. This initial access lets threat actors escalate privileges by using the trusted nature of hardware authentication methods, then move laterally through the environment by registering more compromised security keys on high-privilege accounts. The lack of attestation enforcement creates a pathway for threat actors to establish command and control through persistent hardware-based authentication methods, ultimately leading to data exfiltration or system compromise while maintaining the appearance of legitimate hardware-secured authentication throughout the attack chain. 
+
+**Remediation action**
+
+- [Enable attestation enforcement through the Authentication methods policy configuration](https://learn.microsoft.com/entra/identity/authentication/how-to-enable-passkey-fido2?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-passkey-fido2-authentication-method).
+- [Configure approved list of security keys by Authenticator Attestation Globally Unique Identifier (AAGUID)](https://learn.microsoft.com/entra/identity/authentication/concept-fido2-hardware-vendor?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21840.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21840.ps1
new file mode 100644
index 000000000000..9c007bd3b1f4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21840.ps1
@@ -0,0 +1,72 @@
+function Invoke-CippTestZTNA21840 {
+    <#
+    .SYNOPSIS
+    Security key attestation is enforced
+    #>
+    param($Tenant)
+    #Tested
+    $TestId = 'ZTNA21840'
+
+    try {
+        # Get FIDO2 authentication method policy
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Security key attestation is enforced' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        $Fido2Config = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'Fido2' }
+
+        if (-not $Fido2Config) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Security key attestation is enforced' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        $IsAttestationEnforced = $Fido2Config.isAttestationEnforced
+        $KeyRestrictions = $Fido2Config.keyRestrictions
+
+        $PortalLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods'
+
+        $ResultMarkdown = "`n## [Security key attestation policy details]($PortalLink)`n"
+
+        $AttestationStatus = if ($IsAttestationEnforced -eq $true) { 'True ✅' } else { 'False ❌' }
+        $ResultMarkdown += "- **Enforce attestation** : $AttestationStatus`n"
+
+        if ($KeyRestrictions) {
+            $ResultMarkdown += "- **Key restriction policy** :`n"
+            if ($null -ne $KeyRestrictions.isEnforced) {
+                $ResultMarkdown += "  - **Enforce key restrictions** : $($KeyRestrictions.isEnforced)`n"
+            } else {
+                $ResultMarkdown += "  - **Enforce key restrictions** : Not configured`n"
+            }
+            if ($KeyRestrictions.enforcementType) {
+                $ResultMarkdown += "  - **Restrict specific keys** : $($KeyRestrictions.enforcementType)`n"
+            } else {
+                $ResultMarkdown += "  - **Restrict specific keys** : Not configured`n"
+            }
+
+            if ($KeyRestrictions.aaGuids -and $KeyRestrictions.aaGuids.Count -gt 0) {
+                $ResultMarkdown += "  - **AAGUID** :`n"
+                foreach ($Guid in $KeyRestrictions.aaGuids) {
+                    $ResultMarkdown += "    - $Guid`n"
+                }
+            }
+        }
+
+        $Passed = if ($IsAttestationEnforced -eq $true) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "Security key attestation is properly enforced, ensuring only verified hardware authenticators can be registered.$ResultMarkdown"
+        } else {
+            $ResultMarkdown = "Security key attestation is not enforced, allowing unverified or potentially compromised security keys to be registered.$ResultMarkdown"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Security key attestation is enforced' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Security key attestation is enforced' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21841.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21841.md
new file mode 100644
index 000000000000..e88e14ab14ad
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21841.md
@@ -0,0 +1,10 @@
+Threat actors increasingly rely on prompt bombing and real-time phishing proxies to coerce or trick users into approving fraudulent multifactor authentication (MFA) challenges. Without the Microsoft Authenticator app's **Report suspicious activity** capability enabled, an attacker can iterate until a fatigued user accepts. This type of attack can lead to privilege escalation, persistence, lateral movement into sensitive workloads, data exfiltration, or destructive actions.
+
+When reporting is enabled for all users, any unexpected push or phone prompt can be actively flagged, immediately elevating the user to high user risk and generating a high-fidelity user risk detection (userReportedSuspiciousActivity) that risk-based Conditional Access policies or other response automation can use to block or require secure remediation. 
+
+**Remediation action**
+
+- [Enable the report suspicious activity setting in the Microsoft Authenticator app](https://learn.microsoft.com/entra/identity/authentication/howto-mfa-mfasettings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#report-suspicious-activity)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21841.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21841.ps1
new file mode 100644
index 000000000000..4f17c2b6d6c2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21841.ps1
@@ -0,0 +1,53 @@
+function Invoke-CippTestZTNA21841 {
+    <#
+    .SYNOPSIS
+    Microsoft Authenticator app report suspicious activity setting is enabled
+    #>
+    param($Tenant)
+    #Tested
+    $TestId = 'ZTNA21841'
+
+    try {
+        # Get authentication methods policy
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Microsoft Authenticator app report suspicious activity setting is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        $Passed = 'Failed'
+        $PortalLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AuthMethodsSettings'
+
+        if ($AuthMethodsPolicy.reportSuspiciousActivitySettings) {
+            $ReportSettings = $AuthMethodsPolicy.reportSuspiciousActivitySettings
+
+            $StateEnabled = $ReportSettings.state -eq 'enabled'
+            $TargetAllUsers = $false
+
+            if ($ReportSettings.includeTarget) {
+                $TargetAllUsers = $ReportSettings.includeTarget.id -eq 'all_users'
+            }
+
+            if ($StateEnabled -and $TargetAllUsers) {
+                $Passed = 'Passed'
+                $ResultMarkdown = "Authenticator app report suspicious activity is [enabled for all users]($PortalLink)."
+            } else {
+                if (-not $StateEnabled) {
+                    $ResultMarkdown = "Authenticator app report suspicious activity is [not enabled]($PortalLink)."
+                } elseif (-not $TargetAllUsers) {
+                    $ResultMarkdown = "Authenticator app report suspicious activity is [not configured for all users]($PortalLink)."
+                }
+            }
+        } else {
+            $ResultMarkdown = "Authenticator app report suspicious activity is [not enabled]($PortalLink)."
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Microsoft Authenticator app report suspicious activity setting is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Microsoft Authenticator app report suspicious activity setting is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21842.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21842.md
new file mode 100644
index 000000000000..3fe9d727b41d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21842.md
@@ -0,0 +1,10 @@
+Self-Service Password Reset (SSPR) for administrators allows password changes to happen without strong secondary authentication factors or administrative oversight. Threat actors who compromise administrative credentials can use this capability to bypass other security controls and maintain persistent access to the environment.
+
+Once compromised, attackers can immediately reset the password to lock out legitimate administrators. They can then establish persistence, escalate privileges, and deploy malicious payloads undetected.
+
+**Remediation action**
+
+- [Disable SSPR for administrators by updating the authorization policy](https://learn.microsoft.com/entra/identity/authentication/concept-sspr-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#administrator-reset-policy-differences)  
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21842.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21842.ps1
new file mode 100644
index 000000000000..1f2629709fec
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21842.ps1
@@ -0,0 +1,37 @@
+function Invoke-CippTestZTNA21842 {
+    <#
+    .SYNOPSIS
+    Block administrators from using SSPR
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21842'
+    #Tested
+    try {
+        # Get authorization policy
+        $AuthorizationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthorizationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Block administrators from using SSPR' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        $AllowedToUseSspr = $AuthorizationPolicy.allowedToUseSspr
+        $Passed = 'Failed'
+        $UserMessage = ''
+
+        if ($null -ne $AllowedToUseSspr -and $AllowedToUseSspr -eq $false) {
+            $Passed = 'Passed'
+            $UserMessage = '✅ Administrators are properly blocked from using Self-Service Password Reset, ensuring password changes go through controlled processes.'
+        } else {
+            $UserMessage = '❌ Administrators have access to Self-Service Password Reset, which bypasses security controls and administrative oversight.'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $UserMessage -Risk 'High' -Name 'Block administrators from using SSPR' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Block administrators from using SSPR' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21843.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21843.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21843.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21844.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21844.md
new file mode 100644
index 000000000000..a74cead90b2c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21844.md
@@ -0,0 +1,10 @@
+Threat actors frequently target legacy management interfaces such as the Azure AD PowerShell module (AzureAD and AzureADPreview), which don't support modern authentication, Conditional Access enforcement, or advanced audit logging. Continued use of these modules exposes the environment to risks including weak authentication, bypass of security controls, and incomplete visibility into administrative actions. Attackers can exploit these weaknesses to gain unauthorized access, escalate privileges, and perform malicious changes. 
+
+Block the Azure AD PowerShell module and enforce the use of Microsoft Graph PowerShell or Microsoft Entra PowerShell to ensure that only secure, supported, and auditable management channels are available, which closes critical gaps in the attack chain. 
+
+**Remediation action**
+
+- [Disable user sign-in for application](https://learn.microsoft.com/entra/identity/enterprise-apps/disable-user-sign-in-portal?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21844.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21844.ps1
new file mode 100644
index 000000000000..e0ddd6289188
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21844.ps1
@@ -0,0 +1,82 @@
+function Invoke-CippTestZTNA21844 {
+    <#
+    .SYNOPSIS
+    Block legacy Azure AD PowerShell module
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21844'
+    #Tested
+    try {
+        # Azure AD PowerShell App ID
+        $AzureADPowerShellAppId = '1b730954-1685-4b74-9bfd-dac224a7b894'
+
+        # Query for the Azure AD PowerShell service principal
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+        $ServicePrincipal = $ServicePrincipals | Where-Object { $_.appId -eq $AzureADPowerShellAppId }
+
+        $InvestigateStatus = $false
+        $AppName = 'Azure AD PowerShell'
+        $Passed = 'Failed'
+
+        if (-not $ServicePrincipal -or $ServicePrincipal.Count -eq 0) {
+            $SummaryLines = @(
+                'Summary',
+                '',
+                "- $AppName (Enterprise App not found in tenant)",
+                '- Sign in disabled: N/A',
+                '',
+                "$AppName has not been blocked by the organization."
+            )
+        } else {
+            $SP = $ServicePrincipal[0]
+            $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/Overview/objectId/$($SP.id)/appId/$($SP.appId)"
+            $ServicePrincipalMarkdown = "[$AppName]($PortalLink)"
+
+            if ($SP.accountEnabled -eq $false) {
+                $Passed = 'Passed'
+                $SummaryLines = @(
+                    'Summary',
+                    '',
+                    "- $ServicePrincipalMarkdown",
+                    '- Sign in disabled: Yes',
+                    '',
+                    "$AppName is blocked in the tenant by turning off user sign in to the Azure Active Directory PowerShell Enterprise Application."
+                )
+            } elseif ($SP.appRoleAssignmentRequired -eq $true) {
+                $InvestigateStatus = $true
+                $SummaryLines = @(
+                    'Summary',
+                    '',
+                    "- $ServicePrincipalMarkdown",
+                    '- Sign in disabled: No',
+                    '- User assignment required: Yes',
+                    '',
+                    "App role assignment is required for $AppName. Review assignments and confirm that the app is inaccessible to users."
+                )
+            } else {
+                $SummaryLines = @(
+                    'Summary',
+                    '',
+                    "- $ServicePrincipalMarkdown",
+                    '- Sign in disabled: No',
+                    '',
+                    "$AppName has not been blocked by the organization."
+                )
+            }
+        }
+
+        $ResultMarkdown = $SummaryLines -join "`n"
+
+        if ($InvestigateStatus) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Block legacy Azure AD PowerShell module' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access control'
+        } else {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Block legacy Azure AD PowerShell module' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access control'
+        }
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Block legacy Azure AD PowerShell module' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Access control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21845.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21845.md
new file mode 100644
index 000000000000..a46f492f1452
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21845.md
@@ -0,0 +1,12 @@
+Without Temporary Access Pass (TAP) enabled, organizations face significant challenges in securely bootstrapping user credentials, creating a vulnerability where users rely on weaker authentication mechanisms during their initial setup. When users cannot register phishing-resistant credentials like FIDO2 security keys or Windows Hello for Business due to lack of existing strong authentication methods, they remain exposed to credential-based attacks including phishing, password spray, or similar attacks. Threat actors can exploit this registration gap by targeting users during their most vulnerable state, when they have limited authentication options available and must rely on traditional username + password combinations. This exposure enables threat actors to compromise user accounts during the critical bootstrapping phase, allowing them to intercept or manipulate the registration process for stronger authentication methods, ultimately gaining persistent access to organizational resources and potentially escalating privileges before security controls are fully established. 
+
+Enable TAP and use it with security info registration to secure this potential gap in your defenses.
+
+**Remediation action**
+
+- [Learn how to enable Temporary Access Pass in the Authentication methods policy](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-the-temporary-access-pass-policy)
+- [Learn how to update authentication strength policies to include Temporary Access Pass](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-strength-advanced-options?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Learn how to create a Conditional Access policy for security info registration with authentication strength enforcement](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-security-info-registration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+ <!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21845.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21845.ps1
new file mode 100644
index 000000000000..b8d816cc2c73
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21845.ps1
@@ -0,0 +1,73 @@
+function Invoke-CippTestZTNA21845 {
+    <#
+    .SYNOPSIS
+    Temporary access pass is enabled
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21845'
+    #Tested
+    try {
+        # Get Temporary Access Pass configuration
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+        $TAPConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'TemporaryAccessPass' }
+
+        if (-not $TAPConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Temporary access pass is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        # Check if TAP is disabled
+        if ($TAPConfig.state -ne 'enabled') {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown '❌ Temporary Access Pass is disabled in the tenant.' -Risk 'Medium' -Name 'Temporary access pass is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        # Get conditional access policies
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+        $SecurityInfoPolicies = $CAPolicies | Where-Object {
+            $_.state -eq 'enabled' -and
+            $_.conditions.applications.includeUserActions -contains 'urn:user:registersecurityinfo' -and
+            $_.grantControls.authenticationStrength -ne $null
+        }
+
+        $TAPEnabled = $TAPConfig.state -eq 'enabled'
+        $TargetsAllUsers = $TAPConfig.includeTargets | Where-Object { $_.id -eq 'all_users' }
+        $HasConditionalAccessEnforcement = $SecurityInfoPolicies.Count -gt 0
+
+        # Note: Authentication strength policy validation requires additional API calls not available in cache
+        # Simplified check: verify TAP is enabled, targets all users, and CA policies exist
+        $TAPSupportedInAuthStrength = $HasConditionalAccessEnforcement
+
+        # Determine pass/fail status
+        $Passed = 'Failed'
+        if ($TAPEnabled -and $TargetsAllUsers -and $HasConditionalAccessEnforcement -and $TAPSupportedInAuthStrength) {
+            $Passed = 'Passed'
+            $ResultMarkdown = 'Temporary Access Pass is enabled, targeting all users, and enforced with conditional access policies.'
+        } elseif ($TAPEnabled -and $TargetsAllUsers -and $HasConditionalAccessEnforcement -and -not $TAPSupportedInAuthStrength) {
+            $ResultMarkdown = "Temporary Access Pass is enabled but authentication strength policies don't include TAP methods."
+        } elseif ($TAPEnabled -and $TargetsAllUsers -and -not $HasConditionalAccessEnforcement) {
+            $ResultMarkdown = 'Temporary Access Pass is enabled but no conditional access enforcement for security info registration found. Consider adding conditional access policies for stronger security.'
+        } else {
+            $ResultMarkdown = 'Temporary Access Pass is not properly configured or does not target all users.'
+        }
+
+        $ResultMarkdown += "`n`n**Configuration summary**`n`n"
+
+        $TAPStatus = if ($TAPConfig.state -eq 'enabled') { 'Enabled ✅' } else { 'Disabled ❌' }
+        $ResultMarkdown += "[Temporary Access Pass](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods/fromNav/Identity): $TAPStatus`n`n"
+
+        $CAStatus = if ($HasConditionalAccessEnforcement) { 'Enabled ✅' } else { 'Not enabled ❌' }
+        $ResultMarkdown += "[Conditional Access policy for Security info registration](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies/fromNav/Identity): $CAStatus`n`n"
+
+        $AuthStrengthStatus = if ($TAPSupportedInAuthStrength) { 'Enabled ✅' } else { 'Not enabled ❌' }
+        $ResultMarkdown += "[Authentication strength policy for Temporary Access Pass](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/AuthenticationStrength.ReactView/fromNav/Identity): $AuthStrengthStatus`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Temporary access pass is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Temporary access pass is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21846.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21846.md
new file mode 100644
index 000000000000..dc8bcf1e108f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21846.md
@@ -0,0 +1,8 @@
+When Temporary Access Pass (TAP) is configured to allow multiple uses, threat actors who compromise the credential can reuse it repeatedly during its validity period, extending their unauthorized access window beyond the intended single bootstrapping event. This situation creates an extended opportunity for threat actors to establish persistence by registering additional strong authentication methods under the compromised account during the credential lifetime. A reusable TAP that falls into the wrong hands lets threat actors conduct reconnaissance activities across multiple sessions, gradually mapping the environment and identifying high-value targets while maintaining legitimate-looking access patterns. The compromised TAP can also serve as a reliable backdoor mechanism, allowing threat actors to maintain access even if other compromised credentials are detected and revoked, since the TAP appears as a legitimate administrative tool in security logs.
+
+**Remediation action**
+
+- [Configure Temporary Access Pass for one-time use in authentication methods policy](https://learn.microsoft.com/entra/identity/authentication/howto-authentication-temporary-access-pass?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#enable-the-temporary-access-pass-policy) 
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21846.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21846.ps1
new file mode 100644
index 000000000000..7788f63b92cb
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21846.ps1
@@ -0,0 +1,44 @@
+function Invoke-CippTestZTNA21846 {
+    <#
+    .SYNOPSIS
+    Restrict Temporary Access Pass to Single Use
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21846'
+    #Tested
+    try {
+        # Get Temporary Access Pass configuration
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+        $TAPConfig = $AuthMethodsPolicy.authenticationMethodConfigurations | Where-Object { $_.id -eq 'TemporaryAccessPass' }
+
+        if (-not $TAPConfig) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Restrict Temporary Access Pass to Single Use' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        $Passed = if ($TAPConfig.isUsableOnce -eq $true) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "Temporary Access Pass is configured for one-time use only.`n`n"
+        } else {
+            $ResultMarkdown = "Temporary Access Pass allows multiple uses during validity period.`n`n"
+        }
+
+        $ResultMarkdown += "## Temporary Access Pass Configuration`n`n"
+        $ResultMarkdown += "| Setting | Value | Status |`n"
+        $ResultMarkdown += "| :------ | :---- | :----- |`n"
+
+        $IsUsableOnceValue = if ($TAPConfig.isUsableOnce) { 'Enabled' } else { 'Disabled' }
+        $StatusEmoji = if ($Passed -eq 'Passed') { '✅ Pass' } else { '❌ Fail' }
+
+        $ResultMarkdown += "| [One-time use restriction](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/AdminAuthMethods/fromNav/) | $IsUsableOnceValue | $StatusEmoji |`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Restrict Temporary Access Pass to Single Use' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Restrict Temporary Access Pass to Single Use' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21847.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21847.md
new file mode 100644
index 000000000000..3c5921bf5a0b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21847.md
@@ -0,0 +1,12 @@
+When on-premises password protection isn’t enabled or enforced, threat actors can use low-and-slow password spray with common variants, such as season+year+symbol or local terms, to gain initial access to Active Directory Domain Services accounts. Domain Controllers (DCs) can accept weak passwords when either of the following statements are true:
+
+- Microsoft Entra Password Protection DC agent isn't installed
+- The password protection tenant setting is disabled or in audit-only mode
+
+With valid on-premises credentials, attackers laterally move by reusing passwords across endpoints, escalate to domain admin through local admin reuse or service accounts, and persist by adding backdoors, while weak or disabled enforcement produces fewer blocking events and predictable signals. Microsoft’s design requires a proxy that brokers policy from Microsoft Entra ID and a DC agent that enforces the combined global and tenant custom banned lists on password change/reset; consistent enforcement requires DC agent coverage on all DCs in a domain and using Enforced mode after audit evaluation.
+
+**Remediation action**
+
+- [Deploy Microsoft Entra password protection](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21847.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21847.ps1
new file mode 100644
index 000000000000..89d23d50c6c1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21847.ps1
@@ -0,0 +1,38 @@
+function Invoke-CippTestZTNA21847 {
+    <#
+    .SYNOPSIS
+    Password protection for on-premises is enabled
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21847'
+    #Tested
+    try {
+        # Check if tenant has on-premises sync
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Organization'
+
+        if (-not $Settings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Password protection for on-premises is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        $Org = $Settings[0]
+
+        if ($Org.onPremisesSyncEnabled -ne $true) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Passed' -ResultMarkdown '✅ **Pass**: This tenant is not synchronized to an on-premises environment.' -Risk 'High' -Name 'Password protection for on-premises is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        # Note: Password protection settings require groupSettings API which is not cached
+        # This test requires direct API access to check EnableBannedPasswordCheckOnPremises and BannedPasswordCheckOnPremisesMode
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Password protection for on-premises is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+        return
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Password protection for on-premises is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Password protection for on-premises is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21848.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21848.md
new file mode 100644
index 000000000000..2e03a7464592
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21848.md
@@ -0,0 +1,10 @@
+Organizations that don't populate and enforce the custom banned password list expose themselves to a systematic attack chain where threat actors exploit predictable organizational password patterns. These threat actors typically start with reconnaissance phases, where they gather open-source intelligence (OSINT) from websites, social media, and public records to identify likely password components. With this knowledge, they launch password spray attacks that test organization-specific password variations across multiple user accounts, staying under lockout thresholds to avoid detection. Without the protection the custom banned password list offers, employees often add familiar organizational terms to their passwords, like locations, product names, and industry terms, creating consistent attack vectors. 
+
+The custom banned password list helps organizations plug this critical gap to prevent easily guessed passwords that could lead to initial access and subsequent lateral movement within the environment.
+
+**Remediation action**
+
+- [Learn how to enable custom banned password protection and add organizational terms](https://learn.microsoft.com/entra/identity/authentication/tutorial-configure-custom-password-protection?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21848.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21848.ps1
new file mode 100644
index 000000000000..2622b1616cb2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21848.ps1
@@ -0,0 +1,66 @@
+function Invoke-CippTestZTNA21848 {
+    <#
+    .SYNOPSIS
+    Add organizational terms to the banned password list
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21848'
+    #Tested
+    try {
+        # Get password protection settings from Settings cache
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+        $PasswordProtectionSettings = $Settings | Where-Object { $_.templateId -eq '5cf42378-d67d-4f36-ba46-e8b86229381d' }
+
+        if (-not $PasswordProtectionSettings) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Add organizational terms to the banned password list' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+            return
+        }
+
+        $EnableBannedPasswordCheck = ($PasswordProtectionSettings.values | Where-Object { $_.name -eq 'EnableBannedPasswordCheck' }).value
+        $BannedPasswordList = ($PasswordProtectionSettings.values | Where-Object { $_.name -eq 'BannedPasswordList' }).value
+
+        if ([string]::IsNullOrEmpty($BannedPasswordList)) {
+            $BannedPasswordList = $null
+        }
+
+        $Passed = if ($EnableBannedPasswordCheck -eq $true -and $null -ne $BannedPasswordList) { 'Passed' } else { 'Failed' }
+
+        $PortalLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection/fromNav/'
+
+        $Enforced = if ($EnableBannedPasswordCheck -eq $true) { 'Yes' } else { 'No' }
+
+        # Split on tab characters to handle tab-delimited banned password entries
+        if ($BannedPasswordList) {
+            $BannedPasswordArray = $BannedPasswordList -split '\t'
+        } else {
+            $BannedPasswordArray = @()
+        }
+
+        # Show up to 10 banned passwords, summarize if more exist
+        $MaxDisplay = 10
+        if ($BannedPasswordArray.Count -gt $MaxDisplay) {
+            $DisplayList = $BannedPasswordArray[0..($MaxDisplay - 1)] + "...and $($BannedPasswordArray.Count - $MaxDisplay) more"
+        } else {
+            $DisplayList = $BannedPasswordArray
+        }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = "✅ Custom banned passwords are properly configured with organization-specific terms.`n`n"
+        } else {
+            $ResultMarkdown = "❌ Custom banned passwords are not enabled or lack organization-specific terms.`n`n"
+        }
+
+        $ResultMarkdown += "## [Password protection settings]($PortalLink)`n`n"
+        $ResultMarkdown += "| Enforce custom list | Custom banned password list | Number of terms |`n"
+        $ResultMarkdown += "| :------------------ | :-------------------------- | :-------------- |`n"
+        $ResultMarkdown += "| $Enforced | $($DisplayList -join ', ') | $($BannedPasswordArray.Count) |`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Add organizational terms to the banned password list' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Add organizational terms to the banned password list' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21849.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21849.md
new file mode 100644
index 000000000000..1d3d17582ab0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21849.md
@@ -0,0 +1,8 @@
+When Smart Lockout duration is configured below the default 60 seconds, threat actors can exploit shortened lockout periods to conduct password spray and credential stuffing attacks more effectively. Reduced lockout windows allow attackers to resume authentication attempts more rapidly, increasing their success probability while potentially evading detection systems that rely on longer observation periods. 
+
+**Remediation action**
+
+- [Set Smart Lockout duration to 60 seconds or higher](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#manage-microsoft-entra-smart-lockout-values)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21849.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21849.ps1
new file mode 100644
index 000000000000..3014ca59afee
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21849.ps1
@@ -0,0 +1,61 @@
+function Invoke-CippTestZTNA21849 {
+    <#
+    .SYNOPSIS
+    Smart lockout duration is set to a minimum of 60
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21849'
+    #Tested
+    try {
+        # Get password rule settings from Settings cache
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+        $PasswordRuleSettings = $Settings | Where-Object { $_.displayName -eq 'Password Rule Settings' }
+
+        $PortalLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection/fromNav/'
+
+        if ($null -eq $PasswordRuleSettings) {
+            # Default is 60 seconds
+            $Passed = 'Passed'
+            $ResultMarkdown = "✅ Smart Lockout duration is configured to 60 seconds or higher (default).`n`n"
+            $ResultMarkdown += "## [Smart Lockout Settings]($PortalLink)`n`n"
+            $ResultMarkdown += "| Setting | Value |`n"
+            $ResultMarkdown += "| :---- | :---- |`n"
+            $ResultMarkdown += "| Lockout Duration (seconds) | 60 (Default) |`n"
+        } else {
+            $LockoutDurationSetting = $PasswordRuleSettings.values | Where-Object { $_.name -eq 'LockoutDurationInSeconds' }
+
+            if ($null -eq $LockoutDurationSetting) {
+                # Default is 60 seconds
+                $Passed = 'Passed'
+                $ResultMarkdown = "✅ Smart Lockout duration is configured to 60 seconds or higher (default).`n`n"
+                $ResultMarkdown += "## [Smart Lockout Settings]($PortalLink)`n`n"
+                $ResultMarkdown += "| Setting | Value |`n"
+                $ResultMarkdown += "| :---- | :---- |`n"
+                $ResultMarkdown += "| Lockout Duration (seconds) | 60 (Default) |`n"
+            } else {
+                $LockoutDuration = [int]$LockoutDurationSetting.value
+
+                if ($LockoutDuration -ge 60) {
+                    $Passed = 'Passed'
+                    $ResultMarkdown = "✅ Smart Lockout duration is configured to 60 seconds or higher.`n`n"
+                } else {
+                    $Passed = 'Failed'
+                    $ResultMarkdown = "❌ Smart Lockout duration is configured below 60 seconds.`n`n"
+                }
+
+                $ResultMarkdown += "## [Smart Lockout Settings]($PortalLink)`n`n"
+                $ResultMarkdown += "| Setting | Value |`n"
+                $ResultMarkdown += "| :---- | :---- |`n"
+                $ResultMarkdown += "| Lockout Duration (seconds) | $LockoutDuration |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Smart lockout duration is set to a minimum of 60' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Smart lockout duration is set to a minimum of 60' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21850.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21850.md
new file mode 100644
index 000000000000..fb2a9d166304
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21850.md
@@ -0,0 +1,10 @@
+When the smart lockout threshold is set to more than 10, threat actors can exploit the configuration to conduct reconnaissance, identify valid user accounts without triggering lockout protections, and establish initial access without detection. Once attackers gain initial access, they can move laterally through the environment by using the compromised account to access resources and escalate privileges.
+
+Smart lockout helps lock out bad actors who try to guess your users' passwords or use brute force methods to get in. Smart lockout recognizes sign-ins that come from valid users and treats them differently than ones of attackers and other unknown sources. A threshold of more than 10 provides insufficient protection against automated password spray attacks, making it easier for threat actors to compromise accounts while evading detection mechanisms. 
+
+**Remediation action**
+
+- [Set Microsoft Entra smart lockout threshold to 10 or less](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21850.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21850.ps1
new file mode 100644
index 000000000000..cc372297ec95
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21850.ps1
@@ -0,0 +1,51 @@
+function Invoke-CippTestZTNA21850 {
+    <#
+    .SYNOPSIS
+    Smart lockout threshold set to 10 or less
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21850'
+    #Tested
+    try {
+        # Get password rule settings from Settings cache
+        $Settings = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Settings'
+        $PasswordRuleSettings = $Settings | Where-Object { $_.displayName -eq 'Password Rule Settings' }
+
+        $PortalLink = 'https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection/fromNav/'
+
+        if ($null -eq $PasswordRuleSettings) {
+            $Passed = 'Failed'
+            $ResultMarkdown = '❌ Password rule settings template not found.'
+        } else {
+            $LockoutThresholdSetting = $PasswordRuleSettings.values | Where-Object { $_.name -eq 'LockoutThreshold' }
+
+            if ($null -eq $LockoutThresholdSetting) {
+                $Passed = 'Failed'
+                $ResultMarkdown = "❌ Lockout threshold setting not found in [password rule settings]($PortalLink)."
+            } else {
+                $LockoutThreshold = [int]$LockoutThresholdSetting.value
+
+                if ($LockoutThreshold -le 10) {
+                    $Passed = 'Passed'
+                    $ResultMarkdown = "✅ Smart lockout threshold is set to 10 or below.`n`n"
+                } else {
+                    $Passed = 'Failed'
+                    $ResultMarkdown = "❌ Smart lockout threshold is configured above 10.`n`n"
+                }
+
+                $ResultMarkdown += "## [Smart lockout configuration]($PortalLink)`n`n"
+                $ResultMarkdown += "| Setting | Value |`n"
+                $ResultMarkdown += "| :---- | :---- |`n"
+                $ResultMarkdown += "| Lockout threshold | $LockoutThreshold attempts |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Smart lockout threshold set to 10 or less' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Smart lockout threshold set to 10 or less' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Credential management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21851.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21851.md
new file mode 100644
index 000000000000..833ca37a43d4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21851.md
@@ -0,0 +1,14 @@
+External user accounts are often used to provide access to business partners who belong to organizations that have a business relationship with your organization. If these accounts are compromised in their organization, attackers can use the valid credentials to gain initial access to your environment, often bypassing traditional defenses due to their legitimacy.
+
+Attackers might gain access with external user accounts, if multifactor authentication (MFA) isn't universally enforced or if there are exceptions in place. They might also gain access by exploiting the vulnerabilities of weaker MFA methods like SMS and phone calls using social engineering techniques, such as SIM swapping or phishing, to intercept the authentication codes.
+
+Once an attacker gains access to an account without MFA or a session with weak MFA methods, they might attempt to manipulate MFA settings (for example, registering attacker controlled methods) to establish persistence to plan and execute further attacks based on the privileges of the compromised accounts.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to enforce authentication strength for guests](https://learn.microsoft.com/entra/identity/conditional-access/policy-guests-mfa-strength?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+- For organizations with a closer business relationship and vetting on their MFA practices, consider deploying cross-tenant access settings to accept the MFA claim.
+   - [Configure B2B collaboration cross-tenant access settings](https://learn.microsoft.com/entra/external-id/cross-tenant-access-settings-b2b-collaboration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#to-change-inbound-trust-settings-for-mfa-and-device-claims)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21854.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21854.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21854.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21855.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21855.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21855.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21857.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21857.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21857.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21858.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21858.md
new file mode 100644
index 000000000000..362bc8627a4c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21858.md
@@ -0,0 +1,11 @@
+When guest identities remain active but unused for extended periods, threat actors can exploit these dormant accounts as entry vectors into the organization. Inactive guest accounts represent a significant attack surface because they often maintain persistent access permissions to resources, applications, and data while remaining unmonitored by security teams. Threat actors frequently target these accounts through credential stuffing, password spraying, or by compromising the guest's home organization to gain lateral access. Once an inactive guest account is compromised, attackers can utilize existing access grants to:
+- Move laterally within the tenant
+- Escalate privileges through group memberships or application permissions
+- Establish persistence through techniques like creating more service principals or modifying existing permissions
+
+The prolonged dormancy of these accounts provides attackers with extended dwell time to conduct reconnaissance, exfiltrate sensitive data, and establish backdoors without detection, as organizations typically focus monitoring efforts on active internal users rather than external guest accounts.
+
+**Remediation action**
+- [Monitor and clean up stale guest accounts](https://learn.microsoft.com/en-us/entra/identity/users/clean-up-stale-guest-accounts?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21858.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21858.ps1
new file mode 100644
index 000000000000..053e4f97af4a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21858.ps1
@@ -0,0 +1,93 @@
+function Invoke-CippTestZTNA21858 {
+    <#
+    .SYNOPSIS
+    Inactive guest identities are disabled or removed from the tenant
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $Guests = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Guests'
+        if (-not $Guests) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
+            return
+        }
+
+        $InactivityThresholdDays = 90
+        $Today = Get-Date
+        $EnabledGuests = $Guests | Where-Object { $_.AccountEnabled -eq $true }
+
+        if (-not $EnabledGuests) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No guest users found in the tenant' -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
+            return
+        }
+
+        $InactiveGuests = @()
+        foreach ($Guest in $EnabledGuests) {
+            $DaysSinceLastActivity = $null
+
+            if ($Guest.signInActivity.lastSuccessfulSignInDateTime) {
+                $LastSignIn = [DateTime]$Guest.signInActivity.lastSuccessfulSignInDateTime
+                $DaysSinceLastActivity = ($Today - $LastSignIn).Days
+            } elseif ($Guest.createdDateTime) {
+                $Created = [DateTime]$Guest.createdDateTime
+                $DaysSinceLastActivity = ($Today - $Created).Days
+            }
+
+            if ($null -ne $DaysSinceLastActivity -and $DaysSinceLastActivity -gt $InactivityThresholdDays) {
+                $InactiveGuests += $Guest
+            }
+        }
+
+        if ($InactiveGuests.Count -gt 0) {
+            $Status = 'Failed'
+
+            $ResultLines = @(
+                "Found $($InactiveGuests.Count) inactive guest user(s) with no sign-in activity in the last $InactivityThresholdDays days."
+                ''
+                "**Total enabled guests:** $($EnabledGuests.Count)"
+                "**Inactive guests:** $($InactiveGuests.Count)"
+                "**Inactivity threshold:** $InactivityThresholdDays days"
+                ''
+                '**Top 10 inactive guest users:**'
+            )
+
+            $Top10Guests = $InactiveGuests | Sort-Object {
+                if ($_.signInActivity.lastSuccessfulSignInDateTime) {
+                    [DateTime]$_.signInActivity.lastSuccessfulSignInDateTime
+                } else {
+                    [DateTime]$_.createdDateTime
+                }
+            } | Select-Object -First 10
+
+            foreach ($Guest in $Top10Guests) {
+                if ($Guest.signInActivity.lastSuccessfulSignInDateTime) {
+                    $LastActivity = [DateTime]$Guest.signInActivity.lastSuccessfulSignInDateTime
+                    $DaysInactive = [Math]::Round(($Today - $LastActivity).TotalDays, 0)
+                    $ResultLines += "- $($Guest.displayName) ($($Guest.userPrincipalName)) - Last sign-in: $DaysInactive days ago"
+                } else {
+                    $Created = [DateTime]$Guest.createdDateTime
+                    $DaysSinceCreated = [Math]::Round(($Today - $Created).TotalDays, 0)
+                    $ResultLines += "- $($Guest.displayName) ($($Guest.userPrincipalName)) - Never signed in (Created $DaysSinceCreated days ago)"
+                }
+            }
+
+            if ($InactiveGuests.Count -gt 10) {
+                $ResultLines += "- ... and $($InactiveGuests.Count - 10) more inactive guest(s)"
+            }
+
+            $ResultLines += ''
+            $ResultLines += '**Recommendation:** Review and remove or disable inactive guest accounts to reduce security risks.'
+
+            $Result = $ResultLines -join "`n"
+        } else {
+            $Status = 'Passed'
+            $Result = "All enabled guest users have been active within the last $InactivityThresholdDays days"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21858' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Inactive guest identities are disabled or removed from the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21859.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21859.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21859.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21860.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21860.md
new file mode 100644
index 000000000000..cc0b180268cd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21860.md
@@ -0,0 +1,12 @@
+The activity logs and reports in Microsoft Entra can help detect unauthorized access attempts or identify when tenant configuration changes. When logs are archived or integrated with Security Information and Event Management (SIEM) tools, security teams can implement powerful monitoring and detection security controls, proactive threat hunting, and incident response processes. The logs and monitoring features can be used to assess tenant health and provide evidence for compliance and audits.
+
+If logs aren't regularly archived or sent to a SIEM tool for querying, it's challenging to investigate sign-in issues. The absence of historical logs means that security teams might miss patterns of failed sign-in attempts, unusual activity, and other indicators of compromise. This lack of visibility can prevent the timely detection of breaches, allowing attackers to maintain undetected access for extended periods.
+
+**Remediation action**
+
+- [Configure Microsoft Entra diagnostic settings](https://learn.microsoft.com/entra/identity/monitoring-health/howto-configure-diagnostic-settings?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Integrate Microsoft Entra logs with Azure Monitor logs](https://learn.microsoft.com/entra/identity/monitoring-health/howto-integrate-activity-logs-with-azure-monitor-logs?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Stream Microsoft Entra logs to an event hub](https://learn.microsoft.com/entra/identity/monitoring-health/howto-stream-logs-to-event-hub?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21861.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21861.md
new file mode 100644
index 000000000000..df6a5fb37715
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21861.md
@@ -0,0 +1,11 @@
+Users considered at high risk by Microsoft Entra ID Protection have a high probability of compromise by threat actors. Threat actors can gain initial access via compromised valid accounts, where their suspicious activities continue despite triggering risk indicators. This oversight can enable persistence as threat actors perform activities that normally warrant investigation, such as unusual login patterns or suspicious inbox manipulation. 
+
+A lack of triage of these risky users allows for expanded reconnaissance activities and lateral movement, with anomalous behavior patterns continuing to generate uninvestigated alerts. Threat actors become emboldened as security teams show they aren't actively responding to risk indicators.
+
+**Remediation action**
+
+- [Investigate high risk users](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-investigate-risk?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) in Microsoft Entra ID Protection
+- [Remediate high risk users and unblock](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-remediate-unblock?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) in Microsoft Entra ID Protection
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21861.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21861.ps1
new file mode 100644
index 000000000000..539f2fc8d3db
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21861.ps1
@@ -0,0 +1,55 @@
+function Invoke-CippTestZTNA21861 {
+    <#
+    .SYNOPSIS
+    All high-risk users are triaged
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21861'
+    #Tested
+    try {
+        # Get risky users from cache
+        $RiskyUsers = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RiskyUsers'
+
+        if (-not $RiskyUsers) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'All high-risk users are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+            return
+        }
+
+        # Filter for untriaged high-risk users (atRisk state with High risk level)
+        $UntriagedHighRiskUsers = $RiskyUsers | Where-Object { $_.riskState -eq 'atRisk' -and $_.riskLevel -eq 'high' }
+
+        $Passed = if ($UntriagedHighRiskUsers.Count -eq 0) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = '✅ All high-risk users are properly triaged in Entra ID Protection.'
+        } else {
+            $ResultMarkdown = "❌ Found **$($UntriagedHighRiskUsers.Count)** untriaged high-risk users in Entra ID Protection.`n`n"
+            $ResultMarkdown += "## Untriaged High-Risk Users`n`n"
+            $ResultMarkdown += "| User | Risk level | Last updated | Risk detail |`n"
+            $ResultMarkdown += "| :--- | :--- | :--- | :--- |`n"
+
+            foreach ($User in $UntriagedHighRiskUsers) {
+                $UserPrincipalName = if ($User.userPrincipalName) { $User.userPrincipalName } else { $User.id }
+                $RiskLevel = switch ($User.riskLevel) {
+                    'high' { '🔴 High' }
+                    'medium' { '🟡 Medium' }
+                    'low' { '🟢 Low' }
+                    default { $User.riskLevel }
+                }
+                $RiskDate = $User.riskLastUpdatedDateTime
+                $RiskDetail = $User.riskDetail
+
+                $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_UsersAndTenants/UserProfileMenuBlade/~/overview/userId/$($User.id)"
+                $ResultMarkdown += "| [$UserPrincipalName]($PortalLink) | $RiskLevel | $RiskDate | $RiskDetail |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'All high-risk users are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'All high-risk users are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21862.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21862.md
new file mode 100644
index 000000000000..5d6fdcb41824
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21862.md
@@ -0,0 +1,9 @@
+Compromised workload identities (service principals and applications) allow threat actors to gain persistent access without user interaction or multifactor authentication. Microsoft Entra ID Protection monitors these identities for suspicious activities like leaked credentials, anomalous API traffic, and malicious applications. Unaddressed risky workload identities enable privilege escalation, lateral movement, data exfiltration, and persistent backdoors that bypass traditional security controls. Organizations must systematically investigate and remediate these risks to prevent unauthorized access. 
+
+**Remediation action**
+
+- [Investigate and remediate risky workload identities](https://learn.microsoft.com/entra/id-protection/concept-workload-identity-risk?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#investigate-risky-workload-identities)
+- [Apply Conditional Access policies for workload identities](https://learn.microsoft.com/entra/identity/conditional-access/workload-identity?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21862.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21862.ps1
new file mode 100644
index 000000000000..ed352e74e4fd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21862.ps1
@@ -0,0 +1,84 @@
+function Invoke-CippTestZTNA21862 {
+    <#
+    .SYNOPSIS
+    All risky workload identities are triaged
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21862'
+    #Tested
+    try {
+        # Get risky service principals and risk detections from cache
+        $UntriagedRiskyPrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RiskyServicePrincipals' | Where-Object { $_.riskState -eq 'atRisk' }
+        $ServicePrincipalRiskDetections = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipalRiskDetections'
+        $UntriagedRiskDetections = $ServicePrincipalRiskDetections | Where-Object { $_.riskState -eq 'atRisk' }
+
+        if (-not $UntriagedRiskyPrincipals -and -not $ServicePrincipalRiskDetections) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'All risky workload identities are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+            return
+        }
+
+        $Passed = if (($UntriagedRiskyPrincipals.Count -eq 0) -and ($UntriagedRiskDetections.Count -eq 0)) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = '✅ All risky workload identities have been triaged'
+        } else {
+            $RiskySPCount = $UntriagedRiskyPrincipals.Count
+            $RiskyDetectionCount = $UntriagedRiskDetections.Count
+            $ResultMarkdown = "❌ Found $RiskySPCount untriaged risky service principals and $RiskyDetectionCount untriaged risk detections`n`n"
+
+            if ($RiskySPCount -gt 0) {
+                $ResultMarkdown += "## Untriaged Risky Service Principals`n`n"
+                $ResultMarkdown += "| Service Principal | Type | Risk Level | Risk State | Risk Last Updated |`n"
+                $ResultMarkdown += "| :--- | :--- | :--- | :--- | :--- |`n"
+                foreach ($SP in $UntriagedRiskyPrincipals) {
+                    $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/SignOn/objectId/$($SP.id)/appId/$($SP.appId)"
+                    $RiskLevel = switch ($SP.riskLevel) {
+                        'high' { '🔴 High' }
+                        'medium' { '🟡 Medium' }
+                        'low' { '🟢 Low' }
+                        default { $SP.riskLevel }
+                    }
+                    $RiskState = switch ($SP.riskState) {
+                        'atRisk' { '⚠️ At Risk' }
+                        'confirmedCompromised' { '🔴 Confirmed Compromised' }
+                        'dismissed' { '✅ Dismissed' }
+                        'remediated' { '✅ Remediated' }
+                        default { $SP.riskState }
+                    }
+                    $ResultMarkdown += "| [$($SP.displayName)]($PortalLink) | $($SP.servicePrincipalType) | $RiskLevel | $RiskState | $($SP.riskLastUpdatedDateTime) |`n"
+                }
+            }
+
+            if ($RiskyDetectionCount -gt 0) {
+                $ResultMarkdown += "`n`n## Untriaged Risk Detection Events`n`n"
+                $ResultMarkdown += "| Service Principal | Risk Level | Risk State | Risk Event Type | Risk Last Updated |`n"
+                $ResultMarkdown += "| :--- | :--- | :--- | :--- | :--- |`n"
+                foreach ($Detection in $UntriagedRiskDetections) {
+                    $PortalLink = "https://entra.microsoft.com/#view/Microsoft_AAD_IAM/ManagedAppMenuBlade/~/SignOn/objectId/$($Detection.servicePrincipalId)/appId/$($Detection.appId)"
+                    $RiskLevel = switch ($Detection.riskLevel) {
+                        'high' { '🔴 High' }
+                        'medium' { '🟡 Medium' }
+                        'low' { '🟢 Low' }
+                        default { $Detection.riskLevel }
+                    }
+                    $RiskState = switch ($Detection.riskState) {
+                        'atRisk' { '⚠️ At Risk' }
+                        'confirmedCompromised' { '🔴 Confirmed Compromised' }
+                        'dismissed' { '✅ Dismissed' }
+                        'remediated' { '✅ Remediated' }
+                        default { $Detection.riskState }
+                    }
+                    $ResultMarkdown += "| [$($Detection.servicePrincipalDisplayName)]($PortalLink) | $RiskLevel | $RiskState | $($Detection.riskEventType) | $($Detection.detectedDateTime) |`n"
+                }
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'All risky workload identities are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'All risky workload identities are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21863.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21863.md
new file mode 100644
index 000000000000..7729b0c365ac
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21863.md
@@ -0,0 +1,11 @@
+Risky sign-ins flagged by Microsoft Entra ID Protection indicate a high probability of unauthorized access attempts. Threat actors use these sign-ins to gain an initial foothold. If these sign-ins remain uninvestigated, adversaries can establish persistence by repeatedly authenticating under the guise of legitimate users. 
+
+A lack of response lets attackers execute reconnaissance, attempt to escalate their access, and blend into normal patterns. When untriaged sign-ins continue to generate alerts and there's no intervention, security gaps widen, facilitating lateral movement and defense evasion, as adversaries recognize the absence of an active security response.
+
+**Remediation action**
+
+- [Investigate risky sign-ins](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-investigate-risk?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Remediate risks and unblock users](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-remediate-unblock?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21863.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21863.ps1
new file mode 100644
index 000000000000..eb20d361776d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21863.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestZTNA21863 {
+    <#
+    .SYNOPSIS
+    All high-risk sign-ins are triaged
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21863'
+    #Tested
+    try {
+        # Get risk detections from cache and filter for high-risk untriaged sign-ins
+        $RiskDetections = New-CIPPDbRequest -TenantFilter $Tenant -Type 'RiskDetections'
+
+        if (-not $RiskDetections) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'All high-risk sign-ins are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+            return
+        }
+
+        $UntriagedHighRiskSignIns = $RiskDetections | Where-Object { $_.riskState -eq 'atRisk' -and $_.riskLevel -eq 'high' }
+
+        $Passed = if ($UntriagedHighRiskSignIns.Count -eq 0) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = '✅ No untriaged risky sign ins in the tenant.'
+        } else {
+            $ResultMarkdown = "❌ Found **$($UntriagedHighRiskSignIns.Count)** untriaged high-risk sign ins.`n`n"
+            $ResultMarkdown += "## Untriaged High-Risk Sign ins`n`n"
+            $ResultMarkdown += "| Date | User Principal Name | Type | Risk Level |`n"
+            $ResultMarkdown += "| :---- | :---- | :---- | :---- |`n"
+
+            foreach ($Risk in $UntriagedHighRiskSignIns) {
+                $UserPrincipalName = $Risk.userPrincipalName
+                $RiskLevel = switch ($Risk.riskLevel) {
+                    'high' { '🔴 High' }
+                    'medium' { '🟡 Medium' }
+                    'low' { '🟢 Low' }
+                    default { $Risk.riskLevel }
+                }
+                $RiskEventType = $Risk.riskEventType
+                $RiskDate = $Risk.detectedDateTime
+                $ResultMarkdown += "| $RiskDate | $UserPrincipalName | $RiskEventType | $RiskLevel |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'All high-risk sign-ins are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'All high-risk sign-ins are triaged' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21864.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21864.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21864.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21865.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21865.md
new file mode 100644
index 000000000000..fba7fae508d8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21865.md
@@ -0,0 +1,7 @@
+Without named locations configured in Microsoft Entra ID, threat actors can exploit the absence of location intelligence to conduct attacks without triggering location-based risk detections or security controls. When organizations fail to define named locations for trusted networks, branch offices, and known geographic regions, Microsoft Entra ID Protection can't assess location-based risk signals. Not having these policies in place can lead to increased false positives that create alert fatigue and potentially mask genuine threats. This configuration gap prevents the system from distinguishing between legitimate and illegitimate locations. For example, legitimate sign-ins from corporate networks and suspicious authentication attempts from high-risk locations (anonymous proxy networks, Tor exit nodes, or regions where the organization has no business presence). Threat actors can use this uncertainty to conduct credential stuffing attacks, password spray campaigns, and initial access attempts from malicious infrastructure without triggering location-based detections that would normally flag such activity as suspicious. Organizations can also lose the ability to implement adaptive security policies that could automatically apply stricter authentication requirements or block access entirely from untrusted geographic regions. Threat actors can maintain persistence and conduct lateral movement from any global location without encountering location-based security barriers, which should serve as an extra layer of defense against unauthorized access attempts.
+
+**Remediation action**
+
+- [Configure named locations to define trusted IP ranges and geographic regions for enhanced location-based risk detection and Conditional Access policy enforcement](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21865.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21865.ps1
new file mode 100644
index 000000000000..b250a508c639
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21865.ps1
@@ -0,0 +1,52 @@
+function Invoke-CippTestZTNA21865 {
+    <#
+    .SYNOPSIS
+    Named locations are configured
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21865'
+    #tested
+    try {
+        $NamedLocations = New-CIPPDbRequest -TenantFilter $Tenant -Type 'NamedLocations'
+
+        if (-not $NamedLocations) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Named locations are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+            return
+        }
+
+        $TrustedLocations = @($NamedLocations | Where-Object { $_.isTrusted -eq $true })
+        $Passed = $TrustedLocations.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ Trusted named locations are configured.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No trusted named locations configured.`n`n"
+        }
+
+        $ResultMarkdown += "## Named Locations`n`n"
+        $ResultMarkdown += "$($NamedLocations.Count) named locations found.`n`n"
+
+        if ($NamedLocations.Count -gt 0) {
+            $ResultMarkdown += "| Name | Type | Trusted |`n"
+            $ResultMarkdown += "| :--- | :--- | :------ |`n"
+
+            foreach ($Location in $NamedLocations) {
+                $Name = $Location.displayName
+                $Type = if ($Location.'@odata.type' -eq '#microsoft.graph.ipNamedLocation') { 'IP-based' }
+                elseif ($Location.'@odata.type' -eq '#microsoft.graph.countryNamedLocation') { 'Country-based' }
+                else { 'Unknown' }
+                $Trusted = if ($Location.isTrusted) { 'Yes' } else { 'No' }
+                $ResultMarkdown += "| $Name | $Type | $Trusted |`n"
+            }
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Named locations are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Named locations are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21866.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21866.md
new file mode 100644
index 000000000000..bdfe46a9f74d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21866.md
@@ -0,0 +1,8 @@
+Microsoft Entra recommendations give organizations opportunities to implement best practices and optimize their security posture. Not acting on these items might result in an increased attack surface area, suboptimal operations, or poor user experience.
+
+**Remediation action**
+
+- [Address all active or postponed recommendations in the Microsoft Entra admin center](https://learn.microsoft.com/entra/identity/monitoring-health/overview-recommendations?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#how-does-it-work)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21866.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21866.ps1
new file mode 100644
index 000000000000..754dacc9ff22
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21866.ps1
@@ -0,0 +1,48 @@
+function Invoke-CippTestZTNA21866 {
+    <#
+    .SYNOPSIS
+    All Microsoft Entra recommendations are addressed
+    #>
+    param($Tenant)
+    #Tested
+    $TestId = 'ZTNA21866'
+
+    try {
+        # Get directory recommendations from cache
+        $Recommendations = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DirectoryRecommendations'
+
+        if (-not $Recommendations) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'All Microsoft Entra recommendations are addressed' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Monitoring'
+            return
+        }
+
+        # Filter for unaddressed recommendations (active or postponed status)
+        $UnaddressedRecommendations = $Recommendations | Where-Object { $_.status -in @('active', 'postponed') }
+
+        $Passed = if ($UnaddressedRecommendations.Count -eq 0) { 'Passed' } else { 'Failed' }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = '✅ All Entra Recommendations are addressed.'
+        } else {
+            $ResultMarkdown = "❌ Found $($UnaddressedRecommendations.Count) unaddressed Entra recommendations.`n`n"
+            $ResultMarkdown += "## Unaddressed Entra recommendations`n`n"
+            $ResultMarkdown += "| Display Name | Status | Insights | Priority |`n"
+            $ResultMarkdown += "| :--- | :--- | :--- | :--- |`n"
+
+            foreach ($Item in $UnaddressedRecommendations) {
+                $DisplayName = $Item.displayName
+                $Status = $Item.status
+                $Insights = $Item.insights
+                $Priority = $Item.priority
+                $ResultMarkdown += "| $DisplayName | $Status | $Insights | $Priority |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'All Microsoft Entra recommendations are addressed' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'All Microsoft Entra recommendations are addressed' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Monitoring'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21867.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21867.md
new file mode 100644
index 000000000000..d10b375bc681
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21867.md
@@ -0,0 +1,9 @@
+Without owners, enterprise applications become orphaned assets that threat actors can exploit through credential harvesting and privilege escalation techniques. These applications often retain elevated permissions and access to sensitive resources while lacking proper oversight and security governance. The elevation of privilege to owners can raise a security concern, depending on the application's permissions. More critically, applications without an owner can create uncertainty in security monitoring where threat actors can establish persistence by using existing application permissions to access data or create backdoor accounts without triggering ownership-based detection mechanisms.
+
+When applications lack owners, security teams can't effectively conduct application lifecycle management. This gap leaves applications with potentially excessive permissions, outdated configurations, or compromised credentials that threat actors can discover through enumeration techniques and exploit to move laterally within the environment. The absence of ownership also prevents proper access reviews and permission audits, allowing threat actors to maintain long-term access through applications that should be decommissioned or had their permissions reduced. Not maintaining a clean application portfolio can provide persistent access vectors that can be used for data exfiltration or further compromise of the environment.
+
+**Remediation action**
+
+- [Assign owners to applications](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/assign-app-owners?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21868.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21868.md
new file mode 100644
index 000000000000..c970477e6b2f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21868.md
@@ -0,0 +1,9 @@
+Without restrictions preventing guest users from registering and owning applications, threat actors can exploit external user accounts to establish persistent backdoor access to organizational resources through application registrations that might evade traditional security monitoring. When guest users own applications, compromised guest accounts can be used to exploit guest-owned applications that might have broad permissions. This vulnerability enables threat actors to request access to sensitive organizational data such as emails, files, and user information without the same level of scrutiny for internal user-owned applications.
+
+This attack vector is dangerous because guest-owned applications can be configured to request high-privilege permissions and, once granted consent, provide threat actors with legitimate OAuth tokens. Furthermore, guest-owned applications can serve as command and control infrastructure, so threat actors can maintain access even after the compromised guest account is detected and remediated. Application credentials and permissions might persist independently of the original guest user account, so threat actors can retain access. Guest-owned applications also complicate security auditing and governance efforts, as organizations might have limited visibility into the purpose and security posture of applications registered by external users. These hidden weaknesses in the application lifecycle management make it difficult to assess the true scope of data access granted to non-Microsoft entities through seemingly legitimate application registrations.
+
+**Remediation action**
+- Remove guest users as owners from applications and service principals, and implement controls to prevent future guest user application ownership.
+- [Restrict guest user access permissions](https://learn.microsoft.com/en-us/entra/identity/users/users-restrict-guest-permissions?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21868.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21868.ps1
new file mode 100644
index 000000000000..367b8a2a511f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21868.ps1
@@ -0,0 +1,105 @@
+function Invoke-CippTestZTNA21868 {
+    <#
+    .SYNOPSIS
+    Guests do not own apps in the tenant
+    #>
+    param($Tenant)
+
+    try {
+        $Guests = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Guests'
+        $Apps = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Apps'
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+
+        if (-not $Guests -or -not $Apps -or -not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21868' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Guests do not own apps in the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
+            return
+        }
+
+        # Create a HashSet of guest user IDs for fast lookups
+        $GuestUserIds = [System.Collections.Generic.HashSet[string]]::new()
+        foreach ($guest in $Guests) {
+            [void]$GuestUserIds.Add($guest.id)
+        }
+
+        # Initialize lists for guest owners
+        $GuestAppOwners = [System.Collections.Generic.List[object]]::new()
+        $GuestSpOwners = [System.Collections.Generic.List[object]]::new()
+
+        # Check applications for guest owners
+        foreach ($app in $Apps) {
+            if ($app.owners -and $app.owners.Count -gt 0) {
+                foreach ($owner in $app.owners) {
+                    if ($GuestUserIds.Contains($owner.id)) {
+                        $ownerInfo = [PSCustomObject]@{
+                            id                = $owner.id
+                            displayName       = $owner.displayName
+                            userPrincipalName = $owner.userPrincipalName
+                            appDisplayName    = $app.displayName
+                            appObjectId       = $app.id
+                            appId             = $app.appId
+                        }
+                        $GuestAppOwners.Add($ownerInfo)
+                    }
+                }
+            }
+        }
+
+        # Check service principals for guest owners
+        foreach ($sp in $ServicePrincipals) {
+            if ($sp.owners -and $sp.owners.Count -gt 0) {
+                foreach ($owner in $sp.owners) {
+                    if ($GuestUserIds.Contains($owner.id)) {
+                        $ownerInfo = [PSCustomObject]@{
+                            id                = $owner.id
+                            displayName       = $owner.displayName
+                            userPrincipalName = $owner.userPrincipalName
+                            spDisplayName     = $sp.displayName
+                            spObjectId        = $sp.id
+                            spAppId           = $sp.appId
+                        }
+                        $GuestSpOwners.Add($ownerInfo)
+                    }
+                }
+            }
+        }
+
+        $HasGuestAppOwners = $GuestAppOwners.Count -gt 0
+        $HasGuestSpOwners = $GuestSpOwners.Count -gt 0
+
+        if ($HasGuestAppOwners -or $HasGuestSpOwners) {
+            $Status = 'Failed'
+            $Result = "Guest users own applications or service principals`n`n"
+
+            if ($HasGuestAppOwners -and $HasGuestSpOwners) {
+                $Result += "## Guest users own both applications and service principals`n`n"
+                $Result += "### Applications owned by guest users`n`n"
+                $Result += "| User Display Name | User Principal Name | Application |`n"
+                $Result += "| :---------------- | :------------------ | :---------- |`n"
+                $Result += ($GuestAppOwners | ForEach-Object { "| $($_.displayName) | $($_.userPrincipalName) | $($_.appDisplayName) |" }) -join "`n"
+                $Result += "`n`n### Service principals owned by guest users`n`n"
+                $Result += "| User Display Name | User Principal Name | Service Principal |`n"
+                $Result += "| :---------------- | :------------------ | :---------------- |`n"
+                $Result += ($GuestSpOwners | ForEach-Object { "| $($_.displayName) | $($_.userPrincipalName) | $($_.spDisplayName) |" }) -join "`n"
+            } elseif ($HasGuestAppOwners) {
+                $Result += "## Guest users own applications`n`n"
+                $Result += "| User Display Name | User Principal Name | Application |`n"
+                $Result += "| :---------------- | :------------------ | :---------- |`n"
+                $Result += ($GuestAppOwners | ForEach-Object { "| $($_.displayName) | $($_.userPrincipalName) | $($_.appDisplayName) |" }) -join "`n"
+            } elseif ($HasGuestSpOwners) {
+                $Result += "## Guest users own service principals`n`n"
+                $Result += "| User Display Name | User Principal Name | Service Principal |`n"
+                $Result += "| :---------------- | :------------------ | :---------------- |`n"
+                $Result += ($GuestSpOwners | ForEach-Object { "| $($_.displayName) | $($_.userPrincipalName) | $($_.spDisplayName) |" }) -join "`n"
+            }
+        } else {
+            $Status = 'Passed'
+            $Result = 'No guest users own any applications or service principals in the tenant'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21868' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Guests do not own apps in the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21868' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guests do not own apps in the tenant' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'External collaboration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21869.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21869.md
new file mode 100644
index 000000000000..17fa7ba85d04
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21869.md
@@ -0,0 +1,10 @@
+When enterprise applications lack both explicit assignment requirements AND scoped provisioning controls, threat actors can exploit this dual weakness to gain unauthorized access to sensitive applications and data. The highest risk occurs when applications are configured with the default setting: "Assignment required" is set to "No" *and* provisioning isn't required or scoped. This dangerous combination allows threat actors who compromise any user account within the tenant to immediately access applications with broad user bases, expanding their attack surface and potential for lateral movement within the organization.
+
+While an application with open assignment but proper provisioning scoping (such as department-based filters or group membership requirements) maintains security controls through the provisioning layer, applications lacking both controls create unrestricted access pathways that threat actors can exploit. When applications provision accounts for all users without assignment restrictions, threat actors can abuse compromised accounts to conduct reconnaissance activities, enumerate sensitive data across multiple systems, or use the applications as staging points for further attacks against connected resources. This unrestricted access model is dangerous for applications that have elevated permissions or are connected to critical business systems. Threat actors can use any compromised user account to access sensitive information, modify data, or perform unauthorized actions that the application's permissions allow. The absence of both assignment controls and provisioning scoping also prevents organizations from implementing proper access governance. Without proper governance, it's difficult to track who has access to which applications, when access was granted, and whether access should be revoked based on role changes or employment status. Furthermore, applications with broad provisioning scopes can create cascading security risks where a single compromised account provides access to an entire ecosystem of connected applications and services.
+
+**Remediation action**
+- Evaluate business requirements to determine appropriate access control method. [Restrict a Microsoft Entra app to a set of users](https://learn.microsoft.com/en-us/entra/identity-platform/howto-restrict-your-app-to-a-set-of-users?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+- Configure enterprise applications to require assignment for sensitive applications. [Learn about the "Assignment required" enterprise application property](https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/application-properties?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#assignment-required).
+- Implement scoped provisioning based on groups, departments, or attributes. [Create scoping filters](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/define-conditional-rules-for-provisioning-user-accounts?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-scoping-filters).<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21869.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21869.ps1
new file mode 100644
index 000000000000..dcaa09e51496
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21869.ps1
@@ -0,0 +1,57 @@
+function Invoke-CippTestZTNA21869 {
+    <#
+    .SYNOPSIS
+    Enterprise applications must require explicit assignment or scoped provisioning
+    #>
+    param($Tenant)
+    #tenant
+    try {
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+        if (-not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+            return
+        }
+
+        $AppsWithoutAssignment = $ServicePrincipals | Where-Object {
+            $_.appRoleAssignmentRequired -eq $false -and
+            $null -ne $_.preferredSingleSignOnMode -and
+            $_.preferredSingleSignOnMode -in @('password', 'saml', 'oidc') -and
+            $_.accountEnabled -eq $true
+        }
+
+        if (-not $AppsWithoutAssignment) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'All enterprise applications have explicit assignment requirements' -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+            return
+        }
+
+        $Status = 'Investigate'
+
+        $ResultLines = @(
+            "Found $($AppsWithoutAssignment.Count) enterprise application(s) without assignment requirements."
+            ''
+            '**Applications without user assignment requirements:**'
+        )
+
+        $Top10Apps = $AppsWithoutAssignment | Select-Object -First 10
+        foreach ($App in $Top10Apps) {
+            $ResultLines += "- $($App.displayName) (SSO: $($App.preferredSingleSignOnMode))"
+        }
+
+        if ($AppsWithoutAssignment.Count -gt 10) {
+            $ResultLines += "- ... and $($AppsWithoutAssignment.Count - 10) more application(s)"
+        }
+
+        $ResultLines += ''
+        $ResultLines += '**Note:** Full provisioning scope validation requires Graph API synchronization endpoint not available in cache.'
+        $ResultLines += ''
+        $ResultLines += '**Recommendation:** Enable user assignment requirements or configure scoped provisioning to limit application access.'
+
+        $Result = $ResultLines -join "`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21869' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Enterprise applications must require explicit assignment or scoped provisioning' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21870.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21870.md
new file mode 100644
index 000000000000..91ed1541e019
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21870.md
@@ -0,0 +1,9 @@
+Without Self-Service Password Reset (SSPR) enabled, users with password-related issues must contact help desk support, which can cause in operational delays and lost productivity. There are also potential security vulnerabilities during the extended timeframe required for administrative password resets. These delays not only reduce employee efficiency (especially in time-sensitive roles), but also increase support costs and strain IT resources. During these periods, threat actors might exploit locked accounts through social engineering attacks targeting help desk personnel. Threat actors can potentially convince support staff to reset passwords for accounts they don't legitimately control, enabling initial access to user credentials.
+
+When users are unable to reset their own passwords through secure, automated processes, they frequently resort to insecure workarounds. Examples include sharing accounts with colleagues, using weak passwords that are easier to remember, or writing down passwords in discoverable locations, all of which expand the attack surface for credential harvesting techniques. The lack of SSPR forces users to maintain static passwords for longer periods between administrative resets. This type of password policy increases the likelihood that compromised credentials from previous breaches or password spray attacks remain valid and usable by threat actors. The absence of user-controlled password reset capabilities also delays the response time for users to secure their accounts when they suspect compromise. This delay allows threat actors extended persistence within compromised accounts to perform reconnaissance, establish other access methods, or exfiltrate sensitive data before the account is eventually reset through administrative channels 
+
+**Remediation action**
+
+- [Enable Self-Service Password Reset](https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21872.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21872.md
new file mode 100644
index 000000000000..41edcdf8e024
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21872.md
@@ -0,0 +1,8 @@
+Threat actors can exploit the lack of multifactor authentication during new device registration. Once authenticated, they can register rogue devices, establish persistence, and circumvent security controls tied to trusted endpoints. This foothold enables attackers to exfiltrate sensitive data, deploy malicious applications, or move laterally, depending on the permissions of the accounts being used by the attacker. Without MFA enforcement, risk escalates as adversaries can continuously reauthenticate, evade detection, and execute objectives.
+
+**Remediation action**
+
+- [Deploy a Conditional Access policy to require multifactor authentication for device registration](https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-registration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21872.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21872.ps1
new file mode 100644
index 000000000000..0ccf79cf8d6b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21872.ps1
@@ -0,0 +1,106 @@
+function Invoke-CippTestZTNA21872 {
+    <#
+    .SYNOPSIS
+    Require multifactor authentication for device join and device registration using user action
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21872'
+    #Tested
+    try {
+        # Get conditional access policies and device registration policy from cache
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+        $DeviceRegistrationPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DeviceRegistrationPolicy'
+
+        if (-not $CAPolicies) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
+            return
+        }
+
+        if (-not $DeviceRegistrationPolicy) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
+            return
+        }
+
+        $MfaRequiredInDeviceSettings = $DeviceRegistrationPolicy.multiFactorAuthConfiguration -eq 'required'
+
+        # Filter for enabled device registration CA policies
+        $DeviceRegistrationPolicies = $CAPolicies | Where-Object {
+            ($_.state -eq 'enabled') -and
+            ($_.conditions.applications.includeUserActions -eq 'urn:user:registerdevice')
+        }
+
+        # Check each policy to see if it properly requires MFA
+        $ValidPolicies = [System.Collections.Generic.List[object]]::new()
+        foreach ($Policy in $DeviceRegistrationPolicies) {
+            $RequiresMfa = $false
+
+            # Check if the policy directly requires MFA
+            if ($Policy.grantControls.builtInControls -contains 'mfa') {
+                $RequiresMfa = $true
+            }
+
+            # Check if the policy uses any authentication strength
+            if ($null -ne $Policy.grantControls.authenticationStrength) {
+                $RequiresMfa = $true
+            }
+
+            # If the policy requires MFA, add it to valid policies
+            if ($RequiresMfa) {
+                $ValidPolicies.Add($Policy)
+            }
+        }
+
+        # Determine pass/fail conditions
+        if ($MfaRequiredInDeviceSettings) {
+            $Passed = 'Failed'
+            $ResultMarkdown = "❌ **MFA is configured incorrectly.** Device Settings has 'Require Multi-Factor Authentication to register or join devices' set to Yes. According to best practices, this should be set to No, and MFA should be enforced through Conditional Access policies instead.`n`n"
+        } elseif ($DeviceRegistrationPolicies.Count -eq 0) {
+            $Passed = 'Failed'
+            $ResultMarkdown = "❌ **No Conditional Access policies found** for device registration or device join. Create a policy that requires MFA for these user actions.`n`n"
+        } elseif ($ValidPolicies.Count -eq 0) {
+            $Passed = 'Failed'
+            $ResultMarkdown = "❌ **Conditional Access policies found**, but they're not correctly configured. Policies should require MFA or appropriate authentication strength.`n`n"
+        } else {
+            $Passed = 'Passed'
+            $ResultMarkdown = "✅ **Properly configured Conditional Access policies found** that require MFA for device registration/join actions.`n`n"
+        }
+
+        # Add device settings information
+        $ResultMarkdown += "## Device Settings Configuration`n`n"
+        $ResultMarkdown += "| Setting | Value | Recommended Value | Status |`n"
+        $ResultMarkdown += "| :------ | :---- | :---------------- | :----- |`n"
+
+        $DeviceSettingStatus = if ($MfaRequiredInDeviceSettings) { '❌ Should be set to No' } else { '✅ Correctly configured' }
+        $DeviceSettingValue = if ($MfaRequiredInDeviceSettings) { 'Yes' } else { 'No' }
+        $ResultMarkdown += "| Require Multi-Factor Authentication to register or join devices | $DeviceSettingValue | No | $DeviceSettingStatus |`n"
+
+        # Add policies information if any found
+        if ($DeviceRegistrationPolicies.Count -gt 0) {
+            $ResultMarkdown += "`n## Device Registration/Join Conditional Access Policies`n`n"
+            $ResultMarkdown += "| Policy Name | State | Requires MFA | Status |`n"
+            $ResultMarkdown += "| :---------- | :---- | :----------- | :----- |`n"
+
+            foreach ($Policy in $DeviceRegistrationPolicies) {
+                $PolicyName = $Policy.displayName
+                $PolicyState = $Policy.state
+                $PolicyLink = "https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($Policy.id)"
+                $PolicyNameLink = "[$PolicyName]($PolicyLink)"
+
+                # Check if this policy is properly configured
+                $IsValid = $Policy -in $ValidPolicies
+                $RequiresMfaText = if ($IsValid) { 'Yes' } else { 'No' }
+                $StatusText = if ($IsValid) { '✅ Properly configured' } else { '❌ Incorrectly configured' }
+
+                $ResultMarkdown += "| $PolicyNameLink | $PolicyState | $RequiresMfaText | $StatusText |`n"
+            }
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Require multifactor authentication for device join and device registration using user action' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Access control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21874.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21874.md
new file mode 100644
index 000000000000..9b70ca640329
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21874.md
@@ -0,0 +1,10 @@
+Limiting guest access to a known and approved list of tenants helps to prevent threat actors from exploiting unrestricted guest access to establish initial access through compromised external accounts or by creating accounts in untrusted tenants. Threat actors who gain access through an unrestricted domain can discover internal resources, users, and applications to perform additional attacks. 
+
+Organizations should take inventory and configure an allowlist or blocklist to control B2B collaboration invitations from specific organizations. Without these controls, threat actors might use social engineering techniques to obtain invitations from legitimate internal users. 
+
+**Remediation action**
+
+- Learn how to [set up a list of approved domains](https://learn.microsoft.com/entra/external-id/allow-deny-list?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#add-an-allowlist).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21874.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21874.ps1
new file mode 100644
index 000000000000..3adfce12208b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21874.ps1
@@ -0,0 +1,44 @@
+function Invoke-CippTestZTNA21874 {
+    <#
+    .SYNOPSIS
+    Guest access is limited to approved tenants
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21874'
+    #Trusted
+    try {
+        # Get B2B Management Policy from cache
+        $B2BManagementPolicyObject = New-CIPPDbRequest -TenantFilter $Tenant -Type 'B2BManagementPolicy'
+
+        if (-not $B2BManagementPolicyObject) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'High' -Category 'External collaboration'
+            return
+        }
+
+        $Passed = 'Failed'
+        $AllowedDomains = $null
+
+        if ($B2BManagementPolicyObject.definition) {
+            $B2BManagementPolicy = ($B2BManagementPolicyObject.definition | ConvertFrom-Json).B2BManagementPolicy
+            $AllowedDomains = $B2BManagementPolicy.InvitationsAllowedAndBlockedDomainsPolicy.AllowedDomains
+
+            if ($AllowedDomains -and $AllowedDomains.Count -gt 0) {
+                $Passed = 'Passed'
+            }
+        }
+
+        if ($Passed -eq 'Passed') {
+            $ResultMarkdown = '✅ Allow/Deny lists of domains to restrict external collaboration are configured.'
+        } else {
+            $ResultMarkdown = '❌ Allow/Deny lists of domains to restrict external collaboration are not configured.'
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Passed -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'External collaboration'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Guest access is limited to approved tenants' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'External collaboration'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21875.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21875.md
new file mode 100644
index 000000000000..df03f46ad2ee
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21875.md
@@ -0,0 +1,9 @@
+Access packages configured to allow "All users" instead of specific connected organizations expose your organization to uncontrolled external access. Threat actors can exploit this by requesting access through compromised external accounts from unauthorized organizations, bypassing the principle of least privilege. This enables initial access, reconnaissance, privilege escalation, and lateral movement within your environment. 
+
+**Remediation action**
+
+- [Define trusted organizations as connected organizations](https://learn.microsoft.com/entra/id-governance/entitlement-management-organization?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#view-the-list-of-connected-organizations)
+- [Configure access packages to only allow specific connected organizations](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-create?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#allow-users-not-in-your-directory-to-request-the-access-package)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21876.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21876.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21876.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21877.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21877.md
new file mode 100644
index 000000000000..ed479604ad5b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21877.md
@@ -0,0 +1,15 @@
+Inviting external guests is beneficial for organizational collaboration. However, in the absence of an assigned internal sponsor for each guest, these accounts might persist within the directory without clear accountability. This oversight creates a risk: threat actors could potentially compromise an unused or unmonitored guest account, and then establish an initial foothold within the tenant. Once granted access as an apparent "legitimate" user, an attacker might explore accessible resources and attempt privilege escalation, which could ultimately expose sensitive information or critical systems. An unmonitored guest account might therefore become the vector for unauthorized data access or a significant security breach. A typical attack sequence might use the following pattern, all achieved under the guise of a standard external collaborator:
+
+1. Initial access gained through compromised guest credentials
+1. Persistence due to a lack of oversight.
+1. Further escalation or lateral movement if the guest account possesses group memberships or elevated permissions.
+1. Execution of malicious objectives. 
+
+Mandating that every guest account is assigned to a sponsor directly mitigates this risk. Such a requirement ensures that each external user is linked to a responsible internal party who is expected to regularly monitor and attest to the guest's ongoing need for access. The sponsor feature within Microsoft Entra ID supports accountability by tracking the inviter and preventing the proliferation of "orphaned" guest accounts. When a sponsor manages the guest account lifecycle, such as removing access when collaboration concludes, the opportunity for threat actors to exploit neglected accounts is substantially reduced. This best practice is consistent with Microsoft’s guidance to require sponsorship for business guests as part of an effective guest access governance strategy. It strikes a balance between enabling collaboration and enforcing security, as it guarantees that each guest user's presence and permissions remain under ongoing internal oversight.
+
+**Remediation action**
+- For each guest user that has no sponsor, assign a sponsor in Microsoft Entra ID.
+    - [Add a sponsor to a guest user in the Microsoft Entra admin center](https://learn.microsoft.com/en-us/entra/external-id/b2b-sponsors?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+    - [Add a sponsor to a guest user using Microsoft Graph](https://learn.microsoft.com/graph/api/user-post-sponsors?view=graph-rest-1.0&preserve-view=true&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21877.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21877.ps1
new file mode 100644
index 000000000000..a2272933ab8d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21877.ps1
@@ -0,0 +1,59 @@
+function Invoke-CippTestZTNA21877 {
+    <#
+    .SYNOPSIS
+    All guests have a sponsor
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $Guests = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Guests'
+        if (-not $Guests) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+            return
+        }
+
+        if ($Guests.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No guest accounts found in the tenant' -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+            return
+        }
+
+        $GuestsWithoutSponsors = $Guests | Where-Object { -not $_.sponsors -or $_.sponsors.Count -eq 0 }
+
+        if ($GuestsWithoutSponsors.Count -eq 0) {
+            $Status = 'Passed'
+            $Result = 'All guest accounts in the tenant have an assigned sponsor'
+        } else {
+            $Status = 'Failed'
+
+            $ResultLines = @(
+                "Found $($GuestsWithoutSponsors.Count) guest user(s) without sponsors out of $($Guests.Count) total guests."
+                ''
+                "**Total guests:** $($Guests.Count)"
+                "**Guests without sponsors:** $($GuestsWithoutSponsors.Count)"
+                "**Guests with sponsors:** $($Guests.Count - $GuestsWithoutSponsors.Count)"
+                ''
+                '**Top 10 guests without sponsors:**'
+            )
+
+            $Top10Guests = $GuestsWithoutSponsors | Select-Object -First 10
+            foreach ($Guest in $Top10Guests) {
+                $ResultLines += "- $($Guest.displayName) ($($Guest.userPrincipalName))"
+            }
+
+            if ($GuestsWithoutSponsors.Count -gt 10) {
+                $ResultLines += "- ... and $($GuestsWithoutSponsors.Count - 10) more guest(s)"
+            }
+
+            $ResultLines += ''
+            $ResultLines += '**Recommendation:** Assign sponsors to all guest accounts for better accountability and lifecycle management.'
+
+            $Result = $ResultLines -join "`n"
+        }
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21877' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'All guests have a sponsor' -UserImpact 'Medium' -ImplementationEffort 'Medium' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21878.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21878.md
new file mode 100644
index 000000000000..762389bcce22
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21878.md
@@ -0,0 +1,7 @@
+Entitlement management policies without expiration dates create persistent access that threat actors can exploit. When user assignments lack time bounds, compromised credentials maintain indefinite access, enabling attackers to establish persistence, escalate privileges through additional access packages, and conduct long-term malicious activities while remaining undetected. 
+
+**Remediation action**
+
+- [Configure expiration settings for access packages](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-lifecycle-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#specify-a-lifecycle)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21879.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21879.md
new file mode 100644
index 000000000000..5d2c99793491
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21879.md
@@ -0,0 +1,11 @@
+## Overview
+
+Without enforced approval on entitlement management policies that allow external users, a threat actor can self-orchestrate initial access by submitting unattended requests that are auto-approved. Each successful request provisions or reuses a guest user object and grant access to resources included in the access package, immediately expanding reconnaissance surface. From that foothold the actor can enumerate additional collaboration surfaces, harvest shared files, and probe mis-scoped app permissions to escalate (e.g., abusing over-privileged group-based roles or app role assignments). They can persist by requesting multiple packages with overlapping or escalating privileges, re-extending assignments if expiration or reviews are lax, or by creating indirect sharing links inside granted SharePoint or Teams resources. Absence of an approval gate also removes a human anomaly check (sponsor/internal/external approver) that would otherwise filter suspicious volume, timing, geography, or improbable justification patterns, shrinking detection dwell-time. This accelerates lateral movement (pivoting through granted group memberships to additional workloads), facilitates data staging and exfiltration from SharePoint/Teams or app APIs, and increases the blast radius before downstream controls (access reviews, expirations) eventually trigger. Microsoft’s guidance explicitly states approval should be required when external users can request access to ensure oversight; bypassing it effectively converts a governed onboarding path into an unsupervised provisioning for external identities, expanding tenant-wide risk until manual discovery or periodic governance cycles intervene.
+
+**Remediation action**
+
+- [Configure approval for external request policies (toggle Require approval)](https://learn.microsoft.com/en-us/entra/id-governance/entitlement-management-access-package-approval-policy )
+
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21881.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21881.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21881.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21882.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21882.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21882.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21883.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21883.md
new file mode 100644
index 000000000000..9440b98d3f84
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21883.md
@@ -0,0 +1,8 @@
+Set up risk-based Conditional Access policies for workload identities based on risk policy in Microsoft Entra ID to make sure only trusted and verified workloads use sensitive resources. Without these policies, threat actors can compromise workload identities with minimal detection and perform further attacks. Without conditional controls to detect anomalous activity and other risks, there's no check against malicious operations like token forgery, access to sensitive resources, and disruption of workloads. The lack of automated containment mechanisms increases dwell time and affects the confidentiality, integrity, and availability of critical services.   
+
+**Remediation action**
+Create a risk-based Conditional Access policy for workload identities.
+- [Create a risk-based Conditional Access policy](https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#create-a-risk-based-conditional-access-policy)   
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21883.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21883.ps1
new file mode 100644
index 000000000000..797cb134fddf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21883.ps1
@@ -0,0 +1,133 @@
+function Invoke-CippTestZTNA21883 {
+    <#
+    .SYNOPSIS
+    Checks if workload identities are configured with risk-based policies
+
+    .DESCRIPTION
+    Verifies that Conditional Access policies exist that:
+    - Block authentication based on service principal risk
+    - Are enabled
+    - Target service principals
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #tested
+    try {
+        # Get Conditional Access policies from cache
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $Policies) {
+            $TestParams = @{
+                TestId               = 'ZTNA21883'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'No Conditional Access policies found in cache.'
+                Risk                 = 'Medium'
+                Name                 = 'Workload identities configured with risk-based policies'
+                UserImpact           = 'High'
+                ImplementationEffort = 'Low'
+                Category             = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Filter for policies that:
+        # - Block authentication
+        # - Include service principals
+        # - Are enabled
+        $MatchedPolicies = [System.Collections.Generic.List[object]]::new()
+        foreach ($Policy in $Policies) {
+            $blocksAuth = $false
+            if ($Policy.grantControls.builtInControls) {
+                foreach ($control in $Policy.grantControls.builtInControls) {
+                    if ($control -eq 'block') {
+                        $blocksAuth = $true
+                        break
+                    }
+                }
+            }
+
+            $includesSP = $false
+            if ($Policy.conditions.clientApplications.includeServicePrincipals) {
+                $includesSP = $true
+            }
+
+            $isEnabled = $Policy.state -eq 'enabled'
+
+            if ($blocksAuth -and $includesSP -and $isEnabled) {
+                $MatchedPolicies.Add($Policy)
+            }
+        }
+
+        # Determine pass/fail
+        if ($MatchedPolicies.Count -ge 1) {
+            $Status = 'Passed'
+            $ResultMarkdown = "✅ **Pass**: Workload identities are protected by risk-based Conditional Access policies.`n`n"
+            $ResultMarkdown += "## Matching policies`n`n"
+            $ResultMarkdown += "| Policy name | State | Service principals | Grant controls |`n"
+            $ResultMarkdown += "| :---------- | :---- | :----------------- | :------------- |`n"
+
+            foreach ($Policy in $MatchedPolicies) {
+                $policyLink = "https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($Policy.id)"
+                $policyName = if ($Policy.displayName) { $Policy.displayName } else { 'Unnamed' }
+                $spTargets = if ($Policy.conditions.clientApplications.includeServicePrincipals) {
+                    ($Policy.conditions.clientApplications.includeServicePrincipals | Select-Object -First 3) -join ', '
+                    if ($Policy.conditions.clientApplications.includeServicePrincipals.Count -gt 3) {
+                        $spTargets += " (and $($Policy.conditions.clientApplications.includeServicePrincipals.Count - 3) more)"
+                    }
+                    $spTargets
+                } else {
+                    'None'
+                }
+                $grants = if ($Policy.grantControls.builtInControls) {
+                    $Policy.grantControls.builtInControls -join ', '
+                } else {
+                    'None'
+                }
+                $ResultMarkdown += "| [$policyName]($policyLink) | $($Policy.state) | $spTargets | $grants |`n"
+            }
+        } else {
+            $Status = 'Failed'
+            $ResultMarkdown = "❌ **Fail**: No Conditional Access policies found that protect workload identities with risk-based controls.`n`n"
+            $ResultMarkdown += 'Workload identities should be protected by policies that block authentication when service principal risk is detected.'
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA21883'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'Medium'
+            Name                 = 'Workload identities configured with risk-based policies'
+            UserImpact           = 'High'
+            ImplementationEffort = 'Low'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA21883'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'Medium'
+            Name                 = 'Workload identities configured with risk-based policies'
+            UserImpact           = 'High'
+            ImplementationEffort = 'Low'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21883 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21884.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21884.md
new file mode 100644
index 000000000000..58e372f02ff9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21884.md
@@ -0,0 +1,8 @@
+When workload identities operate without network-based Conditional Access restrictions, threat actors can compromise service principal credentials through various methods, such as exposed secrets in code repositories or intercepted authentication tokens. The threat actors can then use these credentials from any location globally. This unrestricted access enables threat actors to perform reconnaissance activities, enumerate resources, and map the tenant's infrastructure while appearing legitimate. Once the threat actor is established within the environment, they can move laterally between services, access sensitive data stores, and potentially escalate privileges by exploiting overly permissive service-to-service permissions. The lack of network restrictions makes it impossible to detect anomalous access patterns based on location. This gap allows threat actors to maintain persistent access and exfiltrate data over extended periods without triggering security alerts that would normally flag connections from unexpected networks or geographic locations. 
+
+**Remediation action**
+
+- [Configure Conditional Access for workload identities](https://learn.microsoft.com/en-us/entra/identity/conditional-access/workload-identity?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Create named locations](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-assignment-network?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Follow best practices for securing workload identities](https://learn.microsoft.com/en-us/entra/workload-id/workload-identities-overview?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21885.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21885.md
new file mode 100644
index 000000000000..27edc026f6e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21885.md
@@ -0,0 +1,10 @@
+OAuth applications configured with URLs that include wildcards, or URL shorteners increase the attack surface for threat actors. Insecure redirect URIs (reply URLs) might allow adversaries to manipulate authentication requests, hijack authorization codes, and intercept tokens by directing users to attacker-controlled endpoints. Wildcard entries expand the risk by permitting unintended domains to process authentication responses, while shortener URLs might facilitate phishing and token theft in uncontrolled environments. 
+
+Without strict validation of redirect URIs, attackers can bypass security controls, impersonate legitimate applications, and escalate their privileges. This misconfiguration enables persistence, unauthorized access, and lateral movement, as adversaries exploit weak OAuth enforcement to infiltrate protected resources undetected.
+
+**Remediation action**
+
+- [Check the redirect URIs for your application registrations.](https://learn.microsoft.com/entra/identity-platform/reply-url?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) Make sure the redirect URIs don't have *.azurewebsites.net, wildcards, or URL shorteners.
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21886.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21886.md
new file mode 100644
index 000000000000..988a4cbca44d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21886.md
@@ -0,0 +1,15 @@
+When applications that support both authentication and provisioning through Microsoft Entra aren't configured for automatic provisioning, organizations become vulnerable to identity lifecycle gaps that threat actors can exploit. Without automated provisioning, user accounts might persist in applications after employees leave the organization. This vulnerability creates dormant accounts that threat actors can discover through reconnaissance activities. These orphaned accounts often retain their original access permissions but lack active monitoring, making them attractive targets for initial access.
+
+Threat actors who gain access to these dormant accounts can use them to establish persistence in the target application, as the accounts appear legitimate and might not trigger security alerts. From these compromised application accounts, attackers can:
+
+- Attempt to escalate their privileges by exploring application-specific permissions
+- Access sensitive data stored within the application
+- Use the application as a pivot point to access other connected systems
+
+The lack of centralized identity lifecycle management also makes it difficult for security teams to detect when an attacker is using these orphaned accounts, as the accounts might not be properly correlated with the organization's active user directory. 
+
+**Remediation action**
+
+- [Configure application provisioning for missing applications](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/configure-automatic-user-provisioning-portal?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21886.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21886.ps1
new file mode 100644
index 000000000000..674390fef96b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21886.ps1
@@ -0,0 +1,60 @@
+function Invoke-CippTestZTNA21886 {
+    <#
+    .SYNOPSIS
+    Applications are configured for automatic user provisioning
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+        if (-not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
+            return
+        }
+
+        $AppsWithSSO = $ServicePrincipals | Where-Object {
+            $null -ne $_.preferredSingleSignOnMode -and
+            $_.preferredSingleSignOnMode -in @('password', 'saml', 'oidc') -and
+            $_.accountEnabled -eq $true
+        }
+
+        if (-not $AppsWithSSO) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No applications configured for SSO found' -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
+            return
+        }
+
+        $Status = 'Investigate'
+
+        $ResultLines = @(
+            "Found $($AppsWithSSO.Count) application(s) configured for SSO."
+            ''
+            '**Applications with SSO enabled:**'
+        )
+
+        $SSOByType = $AppsWithSSO | Group-Object -Property preferredSingleSignOnMode
+        foreach ($Group in $SSOByType) {
+            $ResultLines += ''
+            $ResultLines += "**$($Group.Name.ToUpper()) SSO** ($($Group.Count) app(s)):"
+            $Top5 = $Group.Group | Select-Object -First 5
+            foreach ($App in $Top5) {
+                $ResultLines += "- $($App.displayName)"
+            }
+            if ($Group.Count -gt 5) {
+                $ResultLines += "- ... and $($Group.Count - 5) more"
+            }
+        }
+
+        $ResultLines += ''
+        $ResultLines += '**Note:** Provisioning template and job validation requires Graph API synchronization endpoint not available in cache.'
+        $ResultLines += ''
+        $ResultLines += '**Recommendation:** Configure automatic user provisioning for applications that support it to ensure consistent access management.'
+
+        $Result = $ResultLines -join "`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21886' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Applications are configured for automatic user provisioning' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Applications management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21887.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21887.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21887.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21888.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21888.md
new file mode 100644
index 000000000000..cb1d03b47129
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21888.md
@@ -0,0 +1,8 @@
+Unmaintained or orphaned redirect URIs in app registrations create significant security vulnerabilities when they reference domains that no longer point to active resources. Threat actors can exploit these "dangling" DNS entries by provisioning resources at abandoned domains, effectively taking control of redirect endpoints. This vulnerability enables attackers to intercept authentication tokens and credentials during OAuth 2.0 flows, which can lead to unauthorized access, session hijacking, and potential broader organizational compromise.
+
+**Remediation action**
+
+- [Redirect URI (reply URL) outline and restrictions](https://learn.microsoft.com/entra/identity-platform/reply-url?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21889.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21889.md
new file mode 100644
index 000000000000..d5f422aa0a93
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21889.md
@@ -0,0 +1,10 @@
+Organizations with extensive user-facing password surfaces expose multiple entry points for threat actors to launch credential-based attacks. Frequent user interactions with password prompts across applications, devices, and workflows increase the risk of exploitation. Threat actors often begin with credential stuffing—using compromised credentials from data breaches—followed by password spraying to test common passwords across multiple accounts. Once initial access is gained, they conduct credential discovery by examining browser password stores, cached credentials in memory, and credential managers to harvest additional authentication materials. These stolen credentials enable lateral movement, allowing attackers to access more systems and applications, often escalating privileges by targeting administrative accounts that still rely on password authentication. In the persistence phase, attackers may create backdoor accounts with password-based access or weaken defenses by altering password policies. To evade detection, they leverage legitimate authentication channels, blending in with normal user activity while maintaining persistent access to organizational resources. 
+
+**Remediation action**
+
+ * [Enable passwordless authentication methods](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication)
+
+ * [Deploy FIDO2 security keys](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21889.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21889.ps1
new file mode 100644
index 000000000000..87caa4f5c591
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21889.ps1
@@ -0,0 +1,147 @@
+function Invoke-CippTestZTNA21889 {
+    <#
+    .SYNOPSIS
+    Checks if organization has reduced password surface area by enabling multiple passwordless authentication methods
+
+    .DESCRIPTION
+    Verifies that both FIDO2 Security Keys and Microsoft Authenticator are enabled with proper configuration
+    to reduce reliance on passwords.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #tested
+    try {
+        # Get authentication methods policy from cache
+        $AuthMethodsPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationMethodsPolicy'
+
+        if (-not $AuthMethodsPolicy) {
+            $TestParams = @{
+                TestId = 'ZTNA21889'
+                TenantFilter = $Tenant
+                TestType = 'ZeroTrustNetworkAccess'
+                Status = 'Skipped'
+                ResultMarkdown = 'Unable to retrieve authentication methods policy from cache.'
+                Risk = 'High'
+                Name = 'Reduce the user-visible password surface area'
+                UserImpact = 'Medium'
+                ImplementationEffort = 'Medium'
+                Category = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Extract FIDO2 and Microsoft Authenticator configurations
+        $Fido2Config = $null
+        $AuthenticatorConfig = $null
+
+        if ($AuthMethodsPolicy.authenticationMethodConfigurations) {
+            foreach ($config in $AuthMethodsPolicy.authenticationMethodConfigurations) {
+                if ($config.id -eq 'Fido2') {
+                    $Fido2Config = $config
+                }
+                if ($config.id -eq 'MicrosoftAuthenticator') {
+                    $AuthenticatorConfig = $config
+                }
+            }
+        }
+
+        # Check FIDO2 configuration
+        $Fido2Enabled = $Fido2Config.state -eq 'enabled'
+        $Fido2HasTargets = $Fido2Config.includeTargets -and $Fido2Config.includeTargets.Count -gt 0
+        $Fido2Valid = $Fido2Enabled -and $Fido2HasTargets
+
+        # Check Microsoft Authenticator configuration
+        $AuthEnabled = $AuthenticatorConfig.state -eq 'enabled'
+        $AuthHasTargets = $AuthenticatorConfig.includeTargets -and $AuthenticatorConfig.includeTargets.Count -gt 0
+        $AuthMode = $null
+        if ($AuthenticatorConfig.includeTargets) {
+            foreach ($target in $AuthenticatorConfig.includeTargets) {
+                if ($target.authenticationMode) {
+                    $AuthMode = $target.authenticationMode
+                    break
+                }
+            }
+        }
+
+        if ([string]::IsNullOrEmpty($AuthMode)) {
+            $AuthMode = 'Not configured'
+            $AuthModeValid = $false
+        } else {
+            $AuthModeValid = ($AuthMode -eq 'any') -or ($AuthMode -eq 'deviceBasedPush')
+        }
+        $AuthValid = $AuthEnabled -and $AuthHasTargets -and $AuthModeValid
+
+        # Determine pass/fail
+        $Status = if ($Fido2Valid -and $AuthValid) { 'Passed' } else { 'Failed' }
+
+        # Build result message
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: Your organization has implemented multiple passwordless authentication methods reducing password exposure.`n`n"
+        } else {
+            $ResultMarkdown = "❌ **Fail**: Your organization relies heavily on password-based authentication, creating security vulnerabilities.`n`n"
+        }
+
+        # Build detailed markdown table
+        $ResultMarkdown += "## Passwordless authentication methods`n`n"
+        $ResultMarkdown += "| Method | State | Include targets | Authentication mode | Status |`n"
+        $ResultMarkdown += "| :----- | :---- | :-------------- | :------------------ | :----- |`n"
+
+        # FIDO2 row
+        $Fido2State = if ($Fido2Enabled) { '✅ Enabled' } else { '❌ Disabled' }
+        $Fido2TargetsDisplay = if ($Fido2Config.includeTargets -and $Fido2Config.includeTargets.Count -gt 0) {
+            "$($Fido2Config.includeTargets.Count) target(s)"
+        } else {
+            'None'
+        }
+        $Fido2Status = if ($Fido2Valid) { '✅ Pass' } else { '❌ Fail' }
+        $ResultMarkdown += "| FIDO2 Security Keys | $Fido2State | $Fido2TargetsDisplay | N/A | $Fido2Status |`n"
+
+        # Microsoft Authenticator row
+        $AuthState = if ($AuthEnabled) { '✅ Enabled' } else { '❌ Disabled' }
+        $AuthTargetsDisplay = if ($AuthenticatorConfig.includeTargets -and $AuthenticatorConfig.includeTargets.Count -gt 0) {
+            "$($AuthenticatorConfig.includeTargets.Count) target(s)"
+        } else {
+            'None'
+        }
+        $AuthModeDisplay = if ($AuthModeValid) { "✅ $AuthMode" } else { "❌ $AuthMode" }
+        $AuthStatus = if ($AuthValid) { '✅ Pass' } else { '❌ Fail' }
+        $ResultMarkdown += "| Microsoft Authenticator | $AuthState | $AuthTargetsDisplay | $AuthModeDisplay | $AuthStatus |`n"
+
+        $TestParams = @{
+            TestId = 'ZTNA21889'
+            TenantFilter = $Tenant
+            TestType = 'ZeroTrustNetworkAccess'
+            Status = $Status
+            ResultMarkdown = $ResultMarkdown
+            Risk = 'High'
+            Name = 'Reduce the user-visible password surface area'
+            UserImpact = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId = 'ZTNA21889'
+            TenantFilter = $Tenant
+            TestType = 'ZeroTrustNetworkAccess'
+            Status = 'Failed'
+            ResultMarkdown = "❌ **Error**: $($_.Exception.Message)"
+            Risk = 'High'
+            Name = 'Reduce the user-visible password surface area'
+            UserImpact = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21889 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21890.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21890.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21890.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21891.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21891.md
new file mode 100644
index 000000000000..9c49450beb91
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21891.md
@@ -0,0 +1,8 @@
+Configuring password reset notifications for administrator roles in Microsoft Entra ID enhances security by notifying privileged administrators when another administrator resets their password. This visibility helps detect unauthorized or suspicious activity that could indicate credential compromise or insider threats. Without these notifications, malicious actors could exploit elevated privileges to establish persistence, escalate access, or extract sensitive data. Proactive notifications support quick action, preserve privileged access integrity, and strengthen the overall security posture.   
+
+**Remediation action**
+
+- [Notify all admins when other admins reset their passwords](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#notify-all-admins-when-other-admins-reset-their-passwords) 
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21892.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21892.md
new file mode 100644
index 000000000000..2d46aed74112
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21892.md
@@ -0,0 +1 @@
+When sign-ins are not restricted to managed devices, threat actors can use unmanaged devices to establish initial access to organizational resources. Unmanaged devices lack organizational security controls, endpoint protection, and compliance verification, creating entry points for threat actors to exploit. Unmanaged devices lack centralized security controls, compliance monitoring, and policy enforcement, creating gaps in the organization's security perimeter. Threat actors can compromise these devices through malware, keyloggers, or credential harvesting tools, then use the captured credentials to authenticate corporate resources without detection. Accounts that are assigned administrative rights are a target for attackers. Requiring users with these highly privileged rights to perform actions from devices marked as compliant or Microsoft Entra hybrid joined can help limit possible exposure. Without device compliance requirements, threat actors can maintain persistence through uncontrolled endpoints, bypass security monitoring that would typically detect anomalous behavior on managed devices and use unmanaged devices as staging areas for lateral movement across network resources. 
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21892.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21892.ps1
new file mode 100644
index 000000000000..12dd5a45cb6d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21892.ps1
@@ -0,0 +1,153 @@
+function Invoke-CippTestZTNA21892 {
+    <#
+    .SYNOPSIS
+    Verifies that all sign-in activity is restricted to managed devices
+
+    .DESCRIPTION
+    Checks for Conditional Access policies that:
+    - Apply to all users
+    - Apply to all applications
+    - Require compliant or hybrid joined devices
+    - Are enabled
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #tested
+    try {
+        # Get Conditional Access policies from cache
+        $Policies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $Policies) {
+            $TestParams = @{
+                TestId               = 'ZTNA21892'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'No Conditional Access policies found in cache.'
+                Risk                 = 'High'
+                Name                 = 'All sign-in activity comes from managed devices'
+                UserImpact           = 'High'
+                ImplementationEffort = 'High'
+                Category             = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Find policies that require managed devices for all users and apps
+        $MatchingPolicies = [System.Collections.Generic.List[object]]::new()
+        foreach ($Policy in $Policies) {
+            # Check if applies to all users
+            $appliesToAllUsers = $false
+            if ($Policy.conditions.users.includeUsers) {
+                foreach ($user in $Policy.conditions.users.includeUsers) {
+                    if ($user -eq 'All') {
+                        $appliesToAllUsers = $true
+                        break
+                    }
+                }
+            }
+
+            # Check if applies to all apps
+            $appliesToAllApps = $false
+            if ($Policy.conditions.applications.includeApplications) {
+                foreach ($app in $Policy.conditions.applications.includeApplications) {
+                    if ($app -eq 'All') {
+                        $appliesToAllApps = $true
+                        break
+                    }
+                }
+            }
+
+            # Check if requires compliant or hybrid joined device
+            $requiresCompliantDevice = $false
+            $requiresHybridJoined = $false
+            if ($Policy.grantControls.builtInControls) {
+                foreach ($control in $Policy.grantControls.builtInControls) {
+                    if ($control -eq 'compliantDevice') {
+                        $requiresCompliantDevice = $true
+                    }
+                    if ($control -eq 'domainJoinedDevice') {
+                        $requiresHybridJoined = $true
+                    }
+                }
+            }
+
+            $isEnabled = $Policy.state -eq 'enabled'
+
+            # Policy matches if enabled, applies to all users/apps, and requires managed device
+            if ($isEnabled -and $appliesToAllUsers -and $appliesToAllApps -and ($requiresCompliantDevice -or $requiresHybridJoined)) {
+                $MatchingPolicies.Add([PSCustomObject]@{
+                        PolicyId           = $Policy.id
+                        PolicyState        = $Policy.state
+                        DisplayName        = $Policy.displayName
+                        AllUsers           = $appliesToAllUsers
+                        AllApps            = $appliesToAllApps
+                        CompliantDevice    = $requiresCompliantDevice
+                        HybridJoinedDevice = $requiresHybridJoined
+                        IsFullyCompliant   = $isEnabled -and $appliesToAllUsers -and $appliesToAllApps -and ($requiresCompliantDevice -or $requiresHybridJoined)
+                    })
+            }
+        }
+
+        # Determine pass/fail
+        if ($MatchingPolicies.Count -gt 0) {
+            $Status = 'Passed'
+            $ResultMarkdown = "✅ **Pass**: Conditional Access policies require managed devices for all sign-in activity.`n`n"
+            $ResultMarkdown += "## Matching policies`n`n"
+            $ResultMarkdown += "| Policy name | State | All users | All apps | Compliant device | Hybrid joined |`n"
+            $ResultMarkdown += "| :---------- | :---- | :-------- | :------- | :--------------- | :------------ |`n"
+
+            foreach ($Policy in $MatchingPolicies) {
+                $policyLink = "https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/PolicyBlade/policyId/$($Policy.PolicyId)"
+                $policyName = if ($Policy.DisplayName) { $Policy.DisplayName } else { 'Unnamed' }
+                $allUsers = if ($Policy.AllUsers) { '✅' } else { '❌' }
+                $allApps = if ($Policy.AllApps) { '✅' } else { '❌' }
+                $compliant = if ($Policy.CompliantDevice) { '✅' } else { '❌' }
+                $hybrid = if ($Policy.HybridJoinedDevice) { '✅' } else { '❌' }
+
+                $ResultMarkdown += "| [$policyName]($policyLink) | $($Policy.PolicyState) | $allUsers | $allApps | $compliant | $hybrid |`n"
+            }
+        } else {
+            $Status = 'Failed'
+            $ResultMarkdown = "❌ **Fail**: No Conditional Access policies found that require managed devices for all sign-in activity.`n`n"
+            $ResultMarkdown += 'Organizations should enforce that all sign-ins come from managed devices (compliant or hybrid Azure AD joined) to ensure security controls are applied.'
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA21892'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'High'
+            Name                 = 'All sign-in activity comes from managed devices'
+            UserImpact           = 'High'
+            ImplementationEffort = 'High'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA21892'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'High'
+            Name                 = 'All sign-in activity comes from managed devices'
+            UserImpact           = 'High'
+            ImplementationEffort = 'High'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21892 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21893.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21893.md
new file mode 100644
index 000000000000..c27b1172c0bb
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21893.md
@@ -0,0 +1,8 @@
+Require multifactor authentication (MFA) registration for all users. Based on studies, your account is more than 99% less likely to be compromised if you're using MFA. Even if you don't require MFA all the time, this policy ensures your users are ready when it's needed.
+
+**Remediation action**
+
+- [Configure the multifactor authentication registration policy](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-mfa-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21894.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21894.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21894.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21895.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21895.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21895.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21896.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21896.md
new file mode 100644
index 000000000000..4e2033aae288
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21896.md
@@ -0,0 +1,9 @@
+Service principals without proper authentication credentials (certificates or client secrets) create security vulnerabilities that allow threat actors to impersonate these identities. This can lead to unauthorized access, lateral movement within your environment, privilege escalation, and persistent access that's difficult to detect and remediate. 
+
+**Remediation action**
+
+- For your organization's service principals: [Add certificates or client secrets to the app registration](https://learn.microsoft.com/entra/identity-platform/how-to-add-credentials?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- For external service principals: Review and remove any unnecessary credentials to reduce security risk
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21896.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21896.ps1
new file mode 100644
index 000000000000..facaf67d0489
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21896.ps1
@@ -0,0 +1,59 @@
+function Invoke-CippTestZTNA21896 {
+    <#
+    .SYNOPSIS
+    Service principals do not have certificates or credentials associated with them
+    #>
+    param($Tenant)
+    #tested
+    try {
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+        if (-not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21896' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Service principals do not have certificates or credentials associated with them' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
+            return
+        }
+
+        $MicrosoftOwnerId = 'f8cdef31-a31e-4b4a-93e4-5f571e91255a'
+        $SPsWithPassCreds = $ServicePrincipals | Where-Object {
+            $_.passwordCredentials -and $_.passwordCredentials.Count -gt 0 -and $_.appOwnerOrganizationId -ne $MicrosoftOwnerId
+        }
+        $SPsWithKeyCreds = $ServicePrincipals | Where-Object {
+            $_.keyCredentials -and $_.keyCredentials.Count -gt 0 -and $_.appOwnerOrganizationId -ne $MicrosoftOwnerId
+        }
+
+        if (-not $SPsWithPassCreds -and -not $SPsWithKeyCreds) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21896' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'Service principals do not have credentials associated with them' -Risk 'Medium' -Name 'Service principals do not have certificates or credentials associated with them' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
+            return
+        }
+
+        $TotalWithCreds = $SPsWithPassCreds.Count + $SPsWithKeyCreds.Count
+        $Status = 'Investigate'
+
+        $ResultLines = @(
+            "Found $TotalWithCreds service principal(s) with credentials configured in the tenant, which represents a security risk."
+            ''
+        )
+
+        if ($SPsWithPassCreds.Count -gt 0) {
+            $ResultLines += "**Service principals with password credentials:** $($SPsWithPassCreds.Count)"
+            $ResultLines += ''
+        }
+
+        if ($SPsWithKeyCreds.Count -gt 0) {
+            $ResultLines += "**Service principals with key credentials (certificates):** $($SPsWithKeyCreds.Count)"
+            $ResultLines += ''
+        }
+
+        $ResultLines += '**Security implications:**'
+        $ResultLines += '- Service principals with credentials can be compromised if not properly secured'
+        $ResultLines += '- Password credentials are less secure than managed identities or certificate-based authentication'
+        $ResultLines += '- Consider using managed identities where possible to eliminate credential management'
+
+        $Result = $ResultLines -join "`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21896' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Service principals do not have certificates or credentials associated with them' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21896' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Service principals do not have certificates or credentials associated with them' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21897.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21897.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21897.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21898.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21898.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21898.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21899.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21899.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21899.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21912.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21912.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21912.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21929.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21929.md
new file mode 100644
index 000000000000..98fe3bbbd22b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21929.md
@@ -0,0 +1,9 @@
+Access packages for guest users without expiration dates or access reviews allow indefinite access to organizational resources. Compromised or stale guest accounts enable threat actors to maintain persistent, undetected access for lateral movement, privilege escalation, and data exfiltration. Without periodic validation, organizations cannot identify when business relationships change or when guest access is no longer needed. 
+
+**Remediation action**
+
+- [Configure lifecycle settings](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-package-lifecycle-policy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Configure access reviews](https://learn.microsoft.com/entra/id-governance/entitlement-management-access-reviews-create?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21941.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21941.md
new file mode 100644
index 000000000000..d00aeef5317c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21941.md
@@ -0,0 +1,18 @@
+Token protection policies in Entra ID tenants are crucial for safeguarding authentication tokens from misuse and unauthorized access. Without these policies, threat actors can intercept and manipulate tokens, leading to unauthorized access to sensitive resources. This can result in data exfiltration, lateral movement within the network, and potential compromise of privileged accounts.
+
+When token protection is not properly configured, threat actors can exploit several attack vectors:
+
+1. **Token theft and replay attacks** - Attackers can steal authentication tokens from compromised devices and replay them from different locations
+2. **Session hijacking** - Without secure sign-in session controls, attackers can hijack legitimate user sessions
+3. **Cross-platform token abuse** - Tokens issued for one platform (like mobile) can be misused on other platforms (like web browsers)
+4. **Persistent access** - Compromised tokens can provide long-term unauthorized access without triggering security alerts
+
+The attack chain typically involves initial access through token theft, followed by privilege escalation and persistence, ultimately leading to data exfiltration and impact across the organization's Microsoft 365 environment.
+
+**Remediation action**
+- [Configure Conditional Access policies as per the best practices](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection#create-a-conditional-access-policy)
+- [Microsoft Entra Conditional Access token protection explained](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection)
+- [Configure session controls in Conditional Access](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-session)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21941.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21941.ps1
new file mode 100644
index 000000000000..879879680277
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21941.ps1
@@ -0,0 +1,192 @@
+function Invoke-CippTestZTNA21941 {
+    <#
+    .SYNOPSIS
+    Checks if token protection policies are enforced for Windows platform
+
+    .DESCRIPTION
+    Verifies that Conditional Access policies with token protection (secureSignInSession) are
+    configured for Windows devices, requiring Office 365 and Microsoft Graph access through
+    protected sessions to prevent token theft.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    try {
+        # Get CA policies from cache
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $CAPolicies) {
+            $TestParams = @{
+                TestId               = 'ZTNA21941'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve Conditional Access policies from cache.'
+                Risk                 = 'High'
+                Name                 = 'Implement token protection policies'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'Medium'
+                Category             = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Required Office 365 and Graph app IDs
+        $RequiredAppIds = @(
+            '00000002-0000-0ff1-ce00-000000000000',  # Office 365 Exchange Online
+            '00000003-0000-0ff1-ce00-000000000000'   # Microsoft Graph
+        )
+
+        # Filter for policies with Windows platform and secureSignInSession control
+        $TokenProtectionPolicies = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($policy in $CAPolicies) {
+            # Check if policy has Windows platform
+            $hasWindows = $false
+            if ($policy.conditions.platforms.includePlatforms) {
+                if ($policy.conditions.platforms.includePlatforms -contains 'windows' -or
+                    $policy.conditions.platforms.includePlatforms -contains 'all') {
+                    $hasWindows = $true
+                }
+            }
+
+            # Check if policy has secureSignInSession control
+            $hasTokenProtection = $false
+            if ($policy.sessionControls -and $policy.sessionControls.signInFrequency) {
+                if ($policy.sessionControls.signInFrequency.isEnabled -eq $true -and
+                    $policy.sessionControls.signInFrequency.authenticationType -eq 'primaryAndSecondaryAuthentication') {
+                    $hasTokenProtection = $true
+                }
+            }
+
+            # Alternative check for newer API format
+            if (-not $hasTokenProtection -and $policy.sessionControls) {
+                foreach ($prop in $policy.sessionControls.PSObject.Properties) {
+                    if ($prop.Name -like '*secureSignIn*' -or $prop.Name -like '*tokenProtection*') {
+                        if ($prop.Value.isEnabled -eq $true) {
+                            $hasTokenProtection = $true
+                            break
+                        }
+                    }
+                }
+            }
+
+            if ($hasWindows -and $hasTokenProtection -and $policy.state -eq 'enabled') {
+                # Check if policy includes users
+                $hasUsers = $false
+                if ($policy.conditions.users.includeUsers -and $policy.conditions.users.includeUsers.Count -gt 0) {
+                    $hasUsers = $true
+                }
+
+                # Check if policy includes required apps
+                $hasRequiredApps = $false
+                if ($policy.conditions.applications.includeApplications) {
+                    $includeAll = $policy.conditions.applications.includeApplications -contains 'All'
+                    if ($includeAll) {
+                        $hasRequiredApps = $true
+                    } else {
+                        $foundApps = 0
+                        foreach ($appId in $RequiredAppIds) {
+                            if ($policy.conditions.applications.includeApplications -contains $appId) {
+                                $foundApps++
+                            }
+                        }
+                        if ($foundApps -eq $RequiredAppIds.Count) {
+                            $hasRequiredApps = $true
+                        }
+                    }
+                }
+
+                $policyStatus = 'Unknown'
+                if ($hasUsers -and $hasRequiredApps) {
+                    $policyStatus = 'Pass'
+                } elseif (-not $hasUsers) {
+                    $policyStatus = 'No users targeted'
+                } elseif (-not $hasRequiredApps) {
+                    $policyStatus = 'Missing required apps'
+                }
+
+                $TokenProtectionPolicies.Add([PSCustomObject]@{
+                        Name            = $policy.displayName
+                        State           = $policy.state
+                        HasUsers        = $hasUsers
+                        HasRequiredApps = $hasRequiredApps
+                        Status          = $policyStatus
+                    })
+            }
+        }
+
+        # Determine overall status
+        $PassingPolicies = $TokenProtectionPolicies | Where-Object { $_.Status -eq 'Pass' }
+        $Status = if ($PassingPolicies.Count -gt 0) { 'Passed' } else { 'Failed' }
+
+        # Build result markdown
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: Token protection policies are properly configured for Windows devices.`n`n"
+            $ResultMarkdown += "Token protection binds authentication tokens to devices, making stolen tokens unusable on other devices.`n`n"
+        } else {
+            if ($TokenProtectionPolicies.Count -eq 0) {
+                $ResultMarkdown = "❌ **Fail**: No token protection policies found for Windows devices.`n`n"
+                $ResultMarkdown += "Without token protection, authentication tokens can be stolen and replayed from other devices.`n`n"
+                $ResultMarkdown += '[Create token protection policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)'
+            } else {
+                $ResultMarkdown = "❌ **Fail**: Token protection policies exist but are not properly configured.`n`n"
+                $ResultMarkdown += "Policies must target users and include both Office 365 and Microsoft Graph applications.`n`n"
+            }
+        }
+
+        if ($TokenProtectionPolicies.Count -gt 0) {
+            $ResultMarkdown += "## Token protection policies`n`n"
+            $ResultMarkdown += "| Policy Name | State | Has Users | Has Required Apps | Status |`n"
+            $ResultMarkdown += "| :---------- | :---- | :-------- | :---------------- | :----- |`n"
+
+            foreach ($policy in $TokenProtectionPolicies) {
+                $stateIcon = if ($policy.State -eq 'enabled') { '✅' } else { '❌' }
+                $usersIcon = if ($policy.HasUsers) { '✅' } else { '❌' }
+                $appsIcon = if ($policy.HasRequiredApps) { '✅' } else { '❌' }
+                $statusIcon = if ($policy.Status -eq 'Pass') { '✅' } else { '❌' }
+
+                $ResultMarkdown += "| $($policy.Name) | $stateIcon $($policy.State) | $usersIcon | $appsIcon | $statusIcon $($policy.Status) |`n"
+            }
+
+            $ResultMarkdown += "`n[Review policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)"
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA21941'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'High'
+            Name                 = 'Implement token protection policies'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA21941'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'High'
+            Name                 = 'Implement token protection policies'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21941 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21953.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21953.md
new file mode 100644
index 000000000000..eeb1984a2ec4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21953.md
@@ -0,0 +1,10 @@
+Without Local Admin Password Solution (LAPS) deployed, threat actors exploit static local administrator passwords to establish initial access. After threat actors compromise a single device with a shared local administrator credential, they can move laterally across the environment and authenticate to other systems sharing the same password. Compromised local administrator access gives threat actors system-level privileges, letting them disable security controls, install persistent backdoors, exfiltrate sensitive data, and establish command and control channels. 
+
+The automated password rotation and centralized management of LAPS closes this security gap and adds controls to help manage who has access to these critical accounts. Without solutions like LAPS, you can't detect or respond to unauthorized use of local administrator accounts, giving threat actors extended dwell time to achieve their objectives while remaining undetected.
+
+**Remediation action**
+
+- [Configure Windows Local Administrator Password Solution](https://learn.microsoft.com/entra/identity/devices/howto-manage-local-admin-passwords?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci).
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21953.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21953.ps1
new file mode 100644
index 000000000000..49d3af03ca3e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21953.ps1
@@ -0,0 +1,84 @@
+function Invoke-CippTestZTNA21953 {
+    <#
+    .SYNOPSIS
+    Checks if Windows Local Administrator Password Solution (LAPS) is deployed in the tenant
+
+    .DESCRIPTION
+    Verifies that LAPS is enabled in the device registration policy to automatically manage
+    and rotate local administrator passwords on Windows devices.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+
+    try {
+        # Get device registration policy from cache
+        $DeviceRegPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DeviceRegistrationPolicy'
+
+        if (-not $DeviceRegPolicy) {
+            $TestParams = @{
+                TestId               = 'ZTNA21953'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve device registration policy from cache.'
+                Risk                 = 'High'
+                Name                 = 'Deploy Windows Local Administrator Password Solution (LAPS)'
+                UserImpact           = 'Low'
+                ImplementationEffort = 'Low'
+                Category             = 'Device security'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Check if LAPS is enabled
+        $LapsEnabled = $DeviceRegPolicy.localAdminPassword.isEnabled -eq $true
+
+        $Status = if ($LapsEnabled) { 'Passed' } else { 'Failed' }
+
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: LAPS is deployed. Your organization can automatically manage and rotate local administrator passwords on all Entra joined and hybrid Entra joined Windows devices.`n`n"
+            $ResultMarkdown += '[Learn more](https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/)'
+        } else {
+            $ResultMarkdown = "❌ **Fail**: LAPS is not deployed. Local administrator passwords may be weak, shared, or unchanged, increasing security risk.`n`n"
+            $ResultMarkdown += '[Deploy LAPS](https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/)'
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA21953'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'High'
+            Name                 = 'Deploy Windows Local Administrator Password Solution (LAPS)'
+            UserImpact           = 'Low'
+            ImplementationEffort = 'Low'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA21953'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'High'
+            Name                 = 'Deploy Windows Local Administrator Password Solution (LAPS)'
+            UserImpact           = 'Low'
+            ImplementationEffort = 'Low'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21953 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21954.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21954.md
new file mode 100644
index 000000000000..a265a8360a51
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21954.md
@@ -0,0 +1,8 @@
+When non-administrator users can access their own BitLocker keys, threat actors who compromise user credentials through phishing, credential stuffing, or malware-based keyloggers gain direct access to encryption keys without requiring privilege escalation. This access vector enables threat actors to persist on the compromised device by accessing encrypted volumes. Once threat actors obtain BitLocker keys, they can decrypt sensitive data stored on the device, including cached credentials, local databases, and confidential files. Without proper restrictions, a single compromised user account provides immediate access to all encrypted data on that device, negating the primary security benefit of disk encryption and creating a pathway for lateral movement to network resources accessed from the compromised system.
+
+**Remediation action**
+
+[Configure BitLocker key access restrictions through Microsoft Entra admin](https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities#view-or-copy-bitlocker-keys)
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21954.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21954.ps1
new file mode 100644
index 000000000000..f74c4b538b44
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21954.ps1
@@ -0,0 +1,83 @@
+function Invoke-CippTestZTNA21954 {
+    <#
+    .SYNOPSIS
+    Checks if non-admin users are restricted from reading BitLocker recovery keys
+
+    .DESCRIPTION
+    Verifies that the authorization policy restricts non-admin users from reading BitLocker
+    recovery keys for their own devices, reducing the risk of unauthorized key access.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    try {
+        # Get authorization policy from cache
+        $AuthPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthorizationPolicy'
+
+        if (-not $AuthPolicy) {
+            $TestParams = @{
+                TestId               = 'ZTNA21954'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve authorization policy from cache.'
+                Risk                 = 'Low'
+                Name                 = 'Restrict non-admin users from reading BitLocker recovery keys'
+                UserImpact           = 'Low'
+                ImplementationEffort = 'Low'
+                Category             = 'Device security'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Check if BitLocker key reading is restricted (should be false)
+        $IsRestricted = $AuthPolicy.defaultUserRolePermissions.allowedToReadBitlockerKeysForOwnedDevice -eq $false
+
+        $Status = if ($IsRestricted) { 'Passed' } else { 'Failed' }
+
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: Non-admin users cannot read BitLocker recovery keys, reducing the risk of unauthorized access.`n`n"
+            $ResultMarkdown += '[Review settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/PoliciesTemplateBlade)'
+        } else {
+            $ResultMarkdown = "❌ **Fail**: Non-admin users can read BitLocker recovery keys for their own devices, which may allow unauthorized access.`n`n"
+            $ResultMarkdown += '[Restrict access](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/PoliciesTemplateBlade)'
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA21954'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'Low'
+            Name                 = 'Restrict non-admin users from reading BitLocker recovery keys'
+            UserImpact           = 'Low'
+            ImplementationEffort = 'Low'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA21954'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'Low'
+            Name                 = 'Restrict non-admin users from reading BitLocker recovery keys'
+            UserImpact           = 'Low'
+            ImplementationEffort = 'Low'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21954 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21955.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21955.md
new file mode 100644
index 000000000000..09ba1be61884
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21955.md
@@ -0,0 +1,8 @@
+When local administrators on Microsoft Entra joined devices aren't properly managed, threat actors with compromised credentials can execute device takeover attacks by removing organizational administrators and disabling the device's connection to Microsoft Entra. This lack of control results in complete loss of organizational control, creating orphaned assets that can't be managed or recovered.
+
+**Remediation action**
+
+- [Manage the local administrators on Microsoft Entra joined devices](https://learn.microsoft.com/entra/identity/devices/assign-local-admin?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#manage-the-microsoft-entra-joined-device-local-administrator-role)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21955.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21955.ps1
new file mode 100644
index 000000000000..dc63407c4576
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21955.ps1
@@ -0,0 +1,83 @@
+function Invoke-CippTestZTNA21955 {
+    <#
+    .SYNOPSIS
+    Checks if local administrator management is properly configured on Entra joined devices
+
+    .DESCRIPTION
+    Verifies that Global Administrators are automatically added as local administrators on
+    Entra joined devices to enable emergency access and device management.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    try {
+        # Get device registration policy from cache
+        $DeviceRegPolicy = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DeviceRegistrationPolicy'
+
+        if (-not $DeviceRegPolicy) {
+            $TestParams = @{
+                TestId               = 'ZTNA21955'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve device registration policy from cache.'
+                Risk                 = 'Medium'
+                Name                 = 'Manage local admins on Entra joined devices'
+                UserImpact           = 'Low'
+                ImplementationEffort = 'Low'
+                Category             = 'Device security'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Check if global admins are added as local admins
+        $GlobalAdminsEnabled = $DeviceRegPolicy.azureADJoin.localAdmins.enableGlobalAdmins -eq $true
+
+        $Status = if ($GlobalAdminsEnabled) { 'Passed' } else { 'Failed' }
+
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: Global Administrators are automatically added as local administrators on Entra joined devices.`n`n"
+            $ResultMarkdown += '[Review settings](https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/)'
+        } else {
+            $ResultMarkdown = "❌ **Fail**: Global Administrators are not automatically added as local administrators, which may limit emergency access capabilities.`n`n"
+            $ResultMarkdown += '[Configure settings](https://entra.microsoft.com/#view/Microsoft_AAD_Devices/DevicesMenuBlade/~/DeviceSettings/menuId/)'
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA21955'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'Medium'
+            Name                 = 'Manage local admins on Entra joined devices'
+            UserImpact           = 'Low'
+            ImplementationEffort = 'Low'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA21955'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'Medium'
+            Name                 = 'Manage local admins on Entra joined devices'
+            UserImpact           = 'Low'
+            ImplementationEffort = 'Low'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA21955 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21964.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21964.md
new file mode 100644
index 000000000000..0dc276f4daf8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21964.md
@@ -0,0 +1,6 @@
+Configure protected actions for Conditional Access policy create, update and delete permissions, and Authentication Context update permission. Refer to the guidance on common stronger Conditional Access policies:
+
+**Remediation action**
+[What are protected actions in Microsoft Entra ID? - Microsoft Entra ID | Microsoft Learn](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/protected-actions-overview)
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21964.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21964.ps1
new file mode 100644
index 000000000000..6e62ea83874f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21964.ps1
@@ -0,0 +1,42 @@
+function Invoke-CippTestZTNA21964 {
+    <#
+    .SYNOPSIS
+    Enable protected actions to secure Conditional Access policy creation and changes
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA21964'
+    #Tested
+    try {
+        $AuthStrengths = New-CIPPDbRequest -TenantFilter $Tenant -Type 'AuthenticationStrengths'
+
+        if (-not $AuthStrengths) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Enable protected actions to secure Conditional Access policy creation and changes' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
+            return
+        }
+
+        $BuiltInStrengths = @($AuthStrengths | Where-Object { $_.policyType -eq 'builtIn' })
+        $CustomStrengths = @($AuthStrengths | Where-Object { $_.policyType -eq 'custom' })
+
+        $ResultMarkdown = "## Authentication Strength Policies`n`n"
+        $ResultMarkdown += "Found $($AuthStrengths.Count) authentication strength policies ($($BuiltInStrengths.Count) built-in, $($CustomStrengths.Count) custom).`n`n"
+
+        if ($CustomStrengths.Count -gt 0) {
+            $ResultMarkdown += "### Custom Authentication Strengths`n`n"
+            $ResultMarkdown += "| Name | Combinations |`n"
+            $ResultMarkdown += "| :--- | :---------- |`n"
+            foreach ($strength in $CustomStrengths) {
+                $combinations = if ($strength.allowedCombinations) { $strength.allowedCombinations.Count } else { 0 }
+                $ResultMarkdown += "| $($strength.displayName) | $combinations methods |`n"
+            }
+        }
+
+        $Status = 'Passed'
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'High' -Name 'Enable protected actions to secure Conditional Access policy creation and changes' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Enable protected actions to secure Conditional Access policy creation and changes' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Access control'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21983.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21983.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21983.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21984.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21984.md
new file mode 100644
index 000000000000..6a740c4322e2
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21984.md
@@ -0,0 +1,6 @@
+...
+
+**Remediation action**
+
+<!--- Results --->
+%TestResult%
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21985.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21985.md
new file mode 100644
index 000000000000..fa3494bd6918
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21985.md
@@ -0,0 +1,9 @@
+Microsoft Entra seamless single sign-on (Seamless SSO) is a legacy authentication feature designed to provide passwordless access for domain-joined devices that are not hybrid Microsoft Entra ID joined. Seamless SSO relies on Kerberos authentication and is primarily beneficial for older operating systems like Windows 7 and Windows 8.1, which do not support Primary Refresh Tokens (PRT). If these legacy systems are no longer present in the environment, continuing to use Seamless SSO introduces unnecessary complexity and potential security exposure. Threat actors could exploit misconfigured or stale Kerberos tickets, or compromise the `AZUREADSSOACC` computer account in Active Directory, which holds the Kerberos decryption key used by Microsoft Entra ID. Once compromised, attackers could impersonate users, bypass modern authentication controls, and gain unauthorized access to cloud resources. Disabling Seamless SSO in environments where it is no longer needed reduces the attack surface and enforces the use of modern, token-based authentication mechanisms that offer stronger protections. 
+
+**Remediation action**
+
+- [Review how Seamless SSO works](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-how-it-works?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Disable Seamless SSO](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-faq?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#how-can-i-disable-seamless-sso-)
+- [Clean up stale devices in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/devices/manage-stale-devices?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21992.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21992.md
new file mode 100644
index 000000000000..feff2e1e7706
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21992.md
@@ -0,0 +1,13 @@
+If certificates aren't rotated regularly, they can give threat actors an extended window to extract and exploit them, leading to unauthorized access. When credentials like these are exposed, attackers can blend their malicious activities with legitimate operations, making it easier to bypass security controls. If an attacker compromises an application’s certificate, they can escalate their privileges within the system, leading to broader access and control, depending on the application's privileges.
+
+Query all of your service principals and application registrations that have certificate credentials. Make sure the certificate start date is less than 180 days.
+
+**Remediation action**
+
+- [Define an application management policy to manage certificate lifetimes](https://learn.microsoft.com/graph/api/resources/applicationauthenticationmethodpolicy?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Define a trusted certificate chain of trust](https://learn.microsoft.com/graph/api/resources/certificatebasedapplicationconfiguration?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Create a least privileged custom role to rotate application credentials](https://learn.microsoft.com/entra/identity/role-based-access-control/custom-create?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci) 
+- [Learn more about app management policies to manage certificate based credentials](https://devblogs.microsoft.com/identity/app-management-policy/)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21992.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21992.ps1
new file mode 100644
index 000000000000..738197a548a8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21992.ps1
@@ -0,0 +1,114 @@
+function Invoke-CippTestZTNA21992 {
+    <#
+    .SYNOPSIS
+    Application certificates must be rotated on a regular basis
+    #>
+    param($Tenant)
+
+    try {
+        $Apps = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Apps'
+        $ServicePrincipals = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipals'
+        #Tested
+        if (-not $Apps -and -not $ServicePrincipals) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21992' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Application certificates must be rotated on a regular basis' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+            return
+        }
+
+        $RotationThresholdDays = 180
+        $ThresholdDate = (Get-Date).AddDays(-$RotationThresholdDays)
+
+        $OldAppCerts = @()
+        if ($Apps) {
+            $OldAppCerts = $Apps | Where-Object {
+                $_.keyCredentials -and $_.keyCredentials.Count -gt 0
+            } | ForEach-Object {
+                $App = $_
+                $OldestCert = $App.keyCredentials | Where-Object { $_.startDateTime } | ForEach-Object {
+                    [DateTime]$_.startDateTime
+                } | Sort-Object | Select-Object -First 1
+
+                if ($OldestCert -and $OldestCert -lt $ThresholdDate) {
+                    [PSCustomObject]@{
+                        Type           = 'Application'
+                        DisplayName    = $App.displayName
+                        AppId          = $App.appId
+                        Id             = $App.id
+                        OldestCertDate = $OldestCert
+                    }
+                }
+            }
+        }
+
+        $OldSPCerts = @()
+        if ($ServicePrincipals) {
+            $OldSPCerts = $ServicePrincipals | Where-Object {
+                $_.keyCredentials -and $_.keyCredentials.Count -gt 0
+            } | ForEach-Object {
+                $SP = $_
+                $OldestCert = $SP.keyCredentials | Where-Object { $_.startDateTime } | ForEach-Object {
+                    [DateTime]$_.startDateTime
+                } | Sort-Object | Select-Object -First 1
+
+                if ($OldestCert -and $OldestCert -lt $ThresholdDate) {
+                    [PSCustomObject]@{
+                        Type           = 'ServicePrincipal'
+                        DisplayName    = $SP.displayName
+                        AppId          = $SP.appId
+                        Id             = $SP.id
+                        OldestCertDate = $OldestCert
+                    }
+                }
+            }
+        }
+
+        if ($OldAppCerts.Count -eq 0 -and $OldSPCerts.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21992' -TestType 'Identity' -Status 'Passed' -ResultMarkdown "Certificates for applications in your tenant have been issued within $RotationThresholdDays days" -Risk 'High' -Name 'Application certificates must be rotated on a regular basis' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+            return
+        }
+
+        $Status = 'Failed'
+
+        $ResultLines = @(
+            "Found $($OldAppCerts.Count) application(s) and $($OldSPCerts.Count) service principal(s) with certificates not rotated within $RotationThresholdDays days."
+            ''
+            "**Certificate rotation threshold:** $RotationThresholdDays days"
+            ''
+        )
+
+        if ($OldAppCerts.Count -gt 0) {
+            $ResultLines += '**Applications with old certificates:**'
+            $Top10Apps = $OldAppCerts | Select-Object -First 10
+            foreach ($App in $Top10Apps) {
+                $DaysOld = [Math]::Round(((Get-Date) - $App.OldestCertDate).TotalDays, 0)
+                $ResultLines += "- $($App.DisplayName) (Certificate age: $DaysOld days)"
+            }
+            if ($OldAppCerts.Count -gt 10) {
+                $ResultLines += "- ... and $($OldAppCerts.Count - 10) more application(s)"
+            }
+            $ResultLines += ''
+        }
+
+        if ($OldSPCerts.Count -gt 0) {
+            $ResultLines += '**Service principals with old certificates:**'
+            $Top10SPs = $OldSPCerts | Select-Object -First 10
+            foreach ($SP in $Top10SPs) {
+                $DaysOld = [Math]::Round(((Get-Date) - $SP.OldestCertDate).TotalDays, 0)
+                $ResultLines += "- $($SP.DisplayName) (Certificate age: $DaysOld days)"
+            }
+            if ($OldSPCerts.Count -gt 10) {
+                $ResultLines += "- ... and $($OldSPCerts.Count - 10) more service principal(s)"
+            }
+            $ResultLines += ''
+        }
+
+        $ResultLines += '**Recommendation:** Rotate certificates regularly to reduce the risk of credential compromise.'
+
+        $Result = $ResultLines -join "`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21992' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Application certificates must be rotated on a regular basis' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA21992' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Application certificates must be rotated on a regular basis' -UserImpact 'Low' -ImplementationEffort 'High' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22072.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22072.md
new file mode 100644
index 000000000000..a44892e995ac
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22072.md
@@ -0,0 +1,11 @@
+Allowing security questions as a self-service password reset (SSPR) method weakens the password reset process because answers are frequently guessable, reused across sites, or discoverable through open-source intelligence (OSINT). Threat actors enumerate or phish users, derive likely responses (family names, schools, and locations), and then trigger password reset flows to bypass stronger methods by exploiting the weaker knowledge-based gate. After they successfully reset a password on an account that isn't protected by multifactor authentication they can: gain valid primary credentials, establish session tokens, and laterally expand by registering more durable authentication methods, add forwarding rules, or exfiltrate sensitive data.
+
+Eliminating this method removes a weak link in the password reset process. Some organizations might have specific business reasons for leaving security questions enabled, but this isn't recommended.
+
+**Remediation action**
+
+- [Disable security questions in SSPR policy](https://learn.microsoft.com/entra/identity/authentication/concept-authentication-security-questions?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Select authentication methods and registration options](https://learn.microsoft.com/entra/identity/authentication/tutorial-enable-sspr?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#select-authentication-methods-and-registration-options)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22124.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22124.md
new file mode 100644
index 000000000000..ed0906a131a4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22124.md
@@ -0,0 +1,8 @@
+Leaving high-priority Microsoft Entra recommendations unaddressed can create a gap in an organization’s security posture, offering threat actors opportunities to exploit known weaknesses. Not acting on these items might result in an increased attack surface area, suboptimal operations, or poor user experience. 
+
+**Remediation action**
+
+- [Address all high priority recommendations in the Microsoft Entra admin center](https://learn.microsoft.com/entra/identity/monitoring-health/overview-recommendations?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#how-does-it-work)
+<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22124.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22124.ps1
new file mode 100644
index 000000000000..defe5a2a1b8e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22124.ps1
@@ -0,0 +1,99 @@
+function Invoke-CippTestZTNA22124 {
+    <#
+    .SYNOPSIS
+    Checks if all high priority Entra recommendations have been addressed
+
+    .DESCRIPTION
+    Verifies that there are no active or postponed high priority recommendations in the tenant,
+    ensuring critical security improvements have been implemented.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    try {
+        # Get directory recommendations from cache
+        $Recommendations = New-CIPPDbRequest -TenantFilter $Tenant -Type 'DirectoryRecommendations'
+
+        if (-not $Recommendations) {
+            $TestParams = @{
+                TestId               = 'ZTNA22124'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve directory recommendations from cache.'
+                Risk                 = 'High'
+                Name                 = 'Address high priority Entra recommendations'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'Medium'
+                Category             = 'Governance'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Filter for high priority recommendations that are active or postponed
+        $HighPriorityIssues = [System.Collections.Generic.List[object]]::new()
+        foreach ($rec in $Recommendations) {
+            if ($rec.priority -eq 'high' -and ($rec.status -eq 'active' -or $rec.status -eq 'postponed')) {
+                $HighPriorityIssues.Add($rec)
+            }
+        }
+
+        $Status = if ($HighPriorityIssues.Count -eq 0) { 'Passed' } else { 'Failed' }
+
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: All high priority Entra recommendations have been addressed.`n`n"
+            $ResultMarkdown += '[View recommendations](https://entra.microsoft.com/#view/Microsoft_Azure_SecureScore/OverviewBlade)'
+        } else {
+            $ResultMarkdown = "❌ **Fail**: There are $($HighPriorityIssues.Count) high priority recommendation(s) that have not been addressed.`n`n"
+            $ResultMarkdown += "## Outstanding high priority recommendations`n`n"
+            $ResultMarkdown += "| Display Name | Status | Insights |`n"
+            $ResultMarkdown += "| :----------- | :----- | :------- |`n"
+
+            foreach ($issue in $HighPriorityIssues) {
+                $displayName = if ($issue.displayName) { $issue.displayName } else { 'N/A' }
+                $status = if ($issue.status) { $issue.status } else { 'N/A' }
+                $insights = if ($issue.insights) { $issue.insights } else { 'N/A' }
+                $ResultMarkdown += "| $displayName | $status | $insights |`n"
+            }
+
+            $ResultMarkdown += "`n[Address recommendations](https://entra.microsoft.com/#view/Microsoft_Azure_SecureScore/OverviewBlade)"
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA22124'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'High'
+            Name                 = 'Address high priority Entra recommendations'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Governance'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA22124'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'High'
+            Name                 = 'Address high priority Entra recommendations'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Governance'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA22124 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22128.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22128.md
new file mode 100644
index 000000000000..ec419c5d76e3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22128.md
@@ -0,0 +1,9 @@
+When guest users are assigned highly privileged directory roles such as Global Administrator or Privileged Role Administrator, organizations create significant security vulnerabilities that threat actors can exploit for initial access through compromised external accounts or business partner environments. Since guest users originate from external organizations without direct control of security policies, threat actors who compromise these external identities can gain privileged access to the target organization's Microsoft Entra tenant.
+
+When threat actors obtain access through compromised guest accounts with elevated privileges, they can escalate their own privilege to create other backdoor accounts, modify security policies, or assign themselves permanent roles within the organization. The compromised privileged guest accounts enable threat actors to establish persistence and then make all the changes they need to remain undetected. For example they could create cloud-only accounts, bypass Conditional Access policies applied to internal users, and maintain access even after the guest's home organization detects the compromise. Threat actors can then conduct lateral movement using administrative privileges to access sensitive resources, modify audit settings, or disable security monitoring across the entire tenant. Threat actors can reach complete compromise of the organization's identity infrastructure while maintaining plausible deniability through the external guest account origin. 
+
+**Remediation action**
+
+- [Remove Guest users from privileged roles](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22128.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22128.ps1
new file mode 100644
index 000000000000..654c9549461d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22128.ps1
@@ -0,0 +1,91 @@
+function Invoke-CippTestZTNA22128 {
+    <#
+    .SYNOPSIS
+    Guests are not assigned high privileged directory roles
+    #>
+    param($Tenant)
+    #Tested
+    try {
+        $Roles = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Roles'
+        $Guests = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Guests'
+
+        if (-not $Roles -or -not $Guests) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA22128' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'High' -Name 'Guests are not assigned high privileged directory roles' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+            return
+        }
+
+        if ($Guests.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA22128' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'No guest users found in tenant' -Risk 'High' -Name 'Guests are not assigned high privileged directory roles' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+            return
+        }
+
+        $GuestIds = $Guests | ForEach-Object { $_.id }
+        $GuestIdHash = @{}
+        foreach ($Guest in $Guests) {
+            $GuestIdHash[$Guest.id] = $Guest
+        }
+
+        $PrivilegedRoleTemplateIds = @(
+            '62e90394-69f5-4237-9190-012177145e10'
+            '194ae4cb-b126-40b2-bd5b-6091b380977d'
+            'f28a1f50-f6e7-4571-818b-6a12f2af6b6c'
+            '29232cdf-9323-42fd-ade2-1d097af3e4de'
+            'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9'
+            '729827e3-9c14-49f7-bb1b-9608f156bbb8'
+            'b0f54661-2d74-4c50-afa3-1ec803f12efe'
+            'fe930be7-5e62-47db-91af-98c3a49a38b1'
+        )
+
+        $GuestsInPrivilegedRoles = @()
+        foreach ($Role in $Roles) {
+            if ($Role.roleTemplateId -in $PrivilegedRoleTemplateIds -and $Role.members) {
+                foreach ($Member in $Role.members) {
+                    if ($GuestIdHash.ContainsKey($Member.id)) {
+                        $GuestsInPrivilegedRoles += [PSCustomObject]@{
+                            RoleName               = $Role.displayName
+                            GuestId                = $Member.id
+                            GuestDisplayName       = $Member.displayName
+                            GuestUserPrincipalName = $Member.userPrincipalName
+                        }
+                    }
+                }
+            }
+        }
+
+        if ($GuestsInPrivilegedRoles.Count -eq 0) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA22128' -TestType 'Identity' -Status 'Passed' -ResultMarkdown 'Guests with privileged roles were not found. All users with privileged roles are members of the tenant' -Risk 'High' -Name 'Guests are not assigned high privileged directory roles' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+            return
+        }
+
+        $Status = 'Failed'
+
+        $ResultLines = @(
+            "Found $($GuestsInPrivilegedRoles.Count) guest user(s) with privileged role assignments."
+            ''
+            "**Total guests in tenant:** $($Guests.Count)"
+            "**Guests with privileged roles:** $($GuestsInPrivilegedRoles.Count)"
+            ''
+            '**Guest users in privileged roles:**'
+        )
+
+        $RoleGroups = $GuestsInPrivilegedRoles | Group-Object -Property RoleName
+        foreach ($RoleGroup in $RoleGroups) {
+            $ResultLines += ''
+            $ResultLines += "**$($RoleGroup.Name)** ($($RoleGroup.Count) guest(s)):"
+            foreach ($Guest in $RoleGroup.Group) {
+                $ResultLines += "- $($Guest.GuestDisplayName) ($($Guest.GuestUserPrincipalName))"
+            }
+        }
+
+        $ResultLines += ''
+        $ResultLines += '**Security concern:** Guest users should not have privileged directory roles. Consider using separate admin accounts for external administrators or removing privileged access.'
+
+        $Result = $ResultLines -join "`n"
+
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA22128' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Guests are not assigned high privileged directory roles' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ZTNA22128' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Guests are not assigned high privileged directory roles' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Application management'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22659.md b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22659.md
new file mode 100644
index 000000000000..a030b51bb467
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22659.md
@@ -0,0 +1,19 @@
+Threat actors increasingly target workload identities (applications, service principals, and managed identities) because they lack human factors and often use long-lived credentials. A compromise often looks like the following path:
+
+1. Credential abuse or key theft.
+1. Non-interactive sign-ins to cloud resources.
+1. Lateral movement via app permissions.
+1. Persistence through new secrets or role assignments.
+
+Microsoft Entra ID Protection continuously generates risky workload identity detections and flags sign-in events with risk state and detail. Risky workload identity sign-ins that aren’t triaged (confirmed compromised, dismissed, or marked safe), detection fatigue, and a large alert backlog can be challenging for IT admins to manage. This heavy workload can let repeated malicious access, privilege escalation, and token replay to continue to go unnoticed. To make the workload manageable, address risky workload identity sign-ins in two parts:
+
+- Close the loop: Triage sign-ins and record an authoritative decision on each risky event.
+- Drive containment: Disable the service principal, rotate credentials, or revoke sessions.
+
+**Remediation action**
+
+- [Investigate risky workload identities and perform appropriate remediation ](https://learn.microsoft.com/en-us/entra/id-protection/concept-workload-identity-risk?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Dismiss workload identity risks when determined to be false positives](https://learn.microsoft.com/graph/api/riskyserviceprincipal-dismiss?view=graph-rest-1.0&preserve-view=true&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
+- [Confirm compromised workload identities when risks are validated](https://learn.microsoft.com/graph/api/riskyserviceprincipal-confirmcompromised?view=graph-rest-1.0&preserve-view=true&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)<!--- Results --->
+%TestResult%
+
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22659.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22659.ps1
new file mode 100644
index 000000000000..fa3636424a16
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA22659.ps1
@@ -0,0 +1,112 @@
+function Invoke-CippTestZTNA22659 {
+    <#
+    .SYNOPSIS
+    Checks if risky workload identity sign-ins have been triaged
+
+    .DESCRIPTION
+    Verifies that there are no active risky sign-in detections for service principals,
+    ensuring that compromised workload identities are properly investigated and remediated.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    try {
+        # Get service principal risk detections from cache
+        $RiskDetections = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ServicePrincipalRiskDetections'
+
+        if (-not $RiskDetections) {
+            $TestParams = @{
+                TestId               = 'ZTNA22659'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve service principal risk detections from cache.'
+                Risk                 = 'High'
+                Name                 = 'Triage risky workload identity sign-ins'
+                UserImpact           = 'High'
+                ImplementationEffort = 'Low'
+                Category             = 'Identity protection'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Filter for sign-in detections that are at risk
+        $RiskySignIns = [System.Collections.Generic.List[object]]::new()
+        foreach ($detection in $RiskDetections) {
+            if ($detection.activity -eq 'signIn' -and $detection.riskState -eq 'atRisk') {
+                $RiskySignIns.Add($detection)
+            }
+        }
+
+        $Status = if ($RiskySignIns.Count -eq 0) { 'Passed' } else { 'Failed' }
+
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: No risky workload identity sign-ins detected or all have been triaged.`n`n"
+            $ResultMarkdown += '[View identity protection](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/RiskyServicePrincipals)'
+        } else {
+            $ResultMarkdown = "❌ **Fail**: There are $($RiskySignIns.Count) risky workload identity sign-in(s) that require investigation.`n`n"
+            $ResultMarkdown += "## Risky service principal sign-ins`n`n"
+            $ResultMarkdown += "| Service Principal | App ID | Risk State | Risk Level | Last Updated |`n"
+            $ResultMarkdown += "| :---------------- | :----- | :--------- | :--------- | :----------- |`n"
+
+            foreach ($signin in $RiskySignIns) {
+                $spName = if ($signin.servicePrincipalDisplayName) { $signin.servicePrincipalDisplayName } else { 'N/A' }
+                $appId = if ($signin.appId) { $signin.appId } else { 'N/A' }
+                $riskState = if ($signin.riskState) { $signin.riskState } else { 'N/A' }
+                $riskLevel = if ($signin.riskLevel) { $signin.riskLevel } else { 'N/A' }
+
+                # Format last updated date
+                $lastUpdated = 'N/A'
+                if ($signin.lastUpdatedDateTime) {
+                    try {
+                        $date = [DateTime]::Parse($signin.lastUpdatedDateTime)
+                        $lastUpdated = $date.ToString('yyyy-MM-dd HH:mm')
+                    } catch {
+                        $lastUpdated = $signin.lastUpdatedDateTime
+                    }
+                }
+
+                $ResultMarkdown += "| $spName | $appId | $riskState | $riskLevel | $lastUpdated |`n"
+            }
+
+            $ResultMarkdown += "`n[Investigate and remediate](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/~/RiskyServicePrincipals)"
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA22659'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'High'
+            Name                 = 'Triage risky workload identity sign-ins'
+            UserImpact           = 'High'
+            ImplementationEffort = 'Low'
+            Category             = 'Identity protection'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA22659'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'High'
+            Name                 = 'Triage risky workload identity sign-ins'
+            UserImpact           = 'High'
+            ImplementationEffort = 'Low'
+            Category             = 'Identity protection'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA22659 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24570.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24570.ps1
new file mode 100644
index 000000000000..08114f3e503f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24570.ps1
@@ -0,0 +1,187 @@
+function Invoke-CippTestZTNA24570 {
+    <#
+    .SYNOPSIS
+    Checks if Entra Connect uses a service principal instead of a user account
+
+    .DESCRIPTION
+    Verifies that if hybrid identity synchronization is enabled (Entra Connect), the
+    Directory Synchronization Accounts role contains only service principals and not user accounts,
+    reducing the risk of credential theft.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    try {
+        # Get organization info to check if hybrid identity is enabled
+        $OrgInfo = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Organization'
+
+        if (-not $OrgInfo) {
+            $TestParams = @{
+                TestId               = 'ZTNA24570'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve organization information from cache.'
+                Risk                 = 'High'
+                Name                 = 'Entra Connect uses a service principal'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'High'
+                Category             = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Check if hybrid identity is enabled
+        $HybridEnabled = $OrgInfo.onPremisesSyncEnabled -eq $true
+
+        if (-not $HybridEnabled) {
+            $TestParams = @{
+                TestId               = 'ZTNA24570'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = '✅ **N/A**: Hybrid identity synchronization is not enabled in this tenant.'
+                Risk                 = 'High'
+                Name                 = 'Entra Connect uses a service principal'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'High'
+                Category             = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Get roles to find Directory Synchronization Accounts role
+        $Roles = New-CIPPDbRequest -TenantFilter $Tenant -Type 'Roles'
+
+        if (-not $Roles) {
+            $TestParams = @{
+                TestId               = 'ZTNA24570'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve roles from cache.'
+                Risk                 = 'High'
+                Name                 = 'Entra Connect uses a service principal'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'High'
+                Category             = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Find Directory Synchronization Accounts role (roleTemplateId: d29b2b05-8046-44ba-8758-1e26182fcf32)
+        $DirSyncRole = $null
+        foreach ($role in $Roles) {
+            if ($role.roleTemplateId -eq 'd29b2b05-8046-44ba-8758-1e26182fcf32') {
+                $DirSyncRole = $role
+                break
+            }
+        }
+
+        if (-not $DirSyncRole) {
+            $TestParams = @{
+                TestId               = 'ZTNA24570'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Failed'
+                ResultMarkdown       = '❌ **Error**: Unable to find Directory Synchronization Accounts role in cache.'
+                Risk                 = 'High'
+                Name                 = 'Entra Connect uses a service principal'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'High'
+                Category             = 'Access control'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Check role members for enabled user accounts
+        $EnabledUsers = [System.Collections.Generic.List[object]]::new()
+        if ($DirSyncRole.members) {
+            foreach ($member in $DirSyncRole.members) {
+                # Check if it's a user (not a service principal) and if it's enabled
+                if ($member.'@odata.type' -eq '#microsoft.graph.user') {
+                    $isEnabled = $member.accountEnabled -eq $true
+                    if ($isEnabled) {
+                        $EnabledUsers.Add([PSCustomObject]@{
+                                DisplayName       = $member.displayName
+                                UserPrincipalName = $member.userPrincipalName
+                                AccountEnabled    = $isEnabled
+                            })
+                    }
+                }
+            }
+        }
+
+        $Status = if ($EnabledUsers.Count -eq 0) { 'Passed' } else { 'Failed' }
+
+        # Build result markdown
+        $lastSyncDate = if ($OrgInfo.onPremisesLastSyncDateTime) {
+            try {
+                $date = [DateTime]::Parse($OrgInfo.onPremisesLastSyncDateTime)
+                $date.ToString('yyyy-MM-dd HH:mm')
+            } catch {
+                $OrgInfo.onPremisesLastSyncDateTime
+            }
+        } else {
+            'Never'
+        }
+
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: Hybrid identity is enabled and using a service principal for synchronization.`n`n"
+            $ResultMarkdown += "**Last Sync**: $lastSyncDate`n`n"
+            $ResultMarkdown += '[Review configuration](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles)'
+        } else {
+            $ResultMarkdown = "❌ **Fail**: Hybrid identity is enabled but using $($EnabledUsers.Count) enabled user account(s) for synchronization.`n`n"
+            $ResultMarkdown += "**Last Sync**: $lastSyncDate`n`n"
+            $ResultMarkdown += "## Directory Synchronization Accounts role members`n`n"
+            $ResultMarkdown += "| Display Name | User Principal Name | Enabled |`n"
+            $ResultMarkdown += "| :----------- | :------------------ | :------ |`n"
+
+            foreach ($user in $EnabledUsers) {
+                $ResultMarkdown += "| $($user.DisplayName) | $($user.UserPrincipalName) | ✅ Yes |`n"
+            }
+
+            $ResultMarkdown += "`n[Migrate to service principal](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/RolesManagementMenuBlade/~/AllRoles)"
+        }
+
+        $TestParams = @{
+            TestId               = 'ZTNA24570'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'High'
+            Name                 = 'Entra Connect uses a service principal'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'High'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA24570'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'High'
+            Name                 = 'Entra Connect uses a service principal'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'High'
+            Category             = 'Access control'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA24570 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24572.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24572.ps1
new file mode 100644
index 000000000000..26fa10a7152d
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24572.ps1
@@ -0,0 +1,51 @@
+function Invoke-CippTestZTNA24572 {
+    <#
+    .SYNOPSIS
+    Device enrollment notifications are enforced to ensure user awareness and secure onboarding
+    #>
+    param($Tenant)
+
+    $TestId = 'ZTNA24572'
+    #Tested
+    try {
+        $EnrollmentConfigs = New-CIPPDbRequest -TenantFilter $Tenant -Type 'IntuneDeviceEnrollmentConfigurations'
+
+        if (-not $EnrollmentConfigs) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Device enrollment notifications are enforced to ensure user awareness and secure onboarding' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+            return
+        }
+
+        $EnrollmentNotifications = @($EnrollmentConfigs | Where-Object {
+                $_.'@odata.type' -eq '#microsoft.graph.windowsEnrollmentStatusScreenSettings' -or
+                $_.'deviceEnrollmentConfigurationType' -eq 'EnrollmentNotificationsConfiguration'
+            })
+
+        $AssignedNotifications = @($EnrollmentNotifications | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
+        $Passed = $AssignedNotifications.Count -gt 0
+
+        if ($Passed) {
+            $ResultMarkdown = "✅ At least one device enrollment notification is configured and assigned.`n`n"
+        } else {
+            $ResultMarkdown = "❌ No device enrollment notification is configured or assigned in Intune.`n`n"
+        }
+
+        if ($EnrollmentNotifications.Count -gt 0) {
+            $ResultMarkdown += "## Device Enrollment Notifications`n`n"
+            $ResultMarkdown += "| Policy Name | Assigned |`n"
+            $ResultMarkdown += "| :---------- | :------- |`n"
+
+            foreach ($policy in $EnrollmentNotifications) {
+                $assigned = if ($policy.assignments -and $policy.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
+                $ResultMarkdown += "| $($policy.displayName) | $assigned |`n"
+            }
+        }
+
+        $Status = if ($Passed) { 'Passed' } else { 'Failed' }
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $ResultMarkdown -Risk 'Medium' -Name 'Device enrollment notifications are enforced to ensure user awareness and secure onboarding' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+        Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Error running test: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Device enrollment notifications are enforced to ensure user awareness and secure onboarding' -UserImpact 'Medium' -ImplementationEffort 'Low' -Category 'Tenant'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24824.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24824.ps1
new file mode 100644
index 000000000000..9dc68cd0c59f
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24824.ps1
@@ -0,0 +1,175 @@
+function Invoke-CippTestZTNA24824 {
+    <#
+    .SYNOPSIS
+    Checks if Conditional Access policies block access from noncompliant devices
+
+    .DESCRIPTION
+    Verifies that enabled Conditional Access policies exist that require device compliance,
+    covering all platforms (Windows, macOS, iOS, Android) or a policy with no platform filter.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested
+    try {
+        # Get CA policies from cache
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $CAPolicies) {
+            $TestParams = @{
+                TestId               = 'ZTNA24824'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve Conditional Access policies from cache.'
+                Risk                 = 'High'
+                Name                 = 'CA policies block access from noncompliant devices'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'Medium'
+                Category             = 'Device security'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Filter for enabled policies with compliantDevice control
+        $CompliantDevicePolicies = [System.Collections.Generic.List[object]]::new()
+        foreach ($policy in $CAPolicies) {
+            if ($policy.state -eq 'enabled' -and
+                $policy.grantControls -and
+                $policy.grantControls.builtInControls -and
+                ($policy.grantControls.builtInControls -contains 'compliantDevice')) {
+                $CompliantDevicePolicies.Add($policy)
+            }
+        }
+
+        if ($CompliantDevicePolicies.Count -eq 0) {
+            $TestParams = @{
+                TestId               = 'ZTNA24824'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Failed'
+                ResultMarkdown       = "❌ **Fail**: No Conditional Access policies found that block access from noncompliant devices.`n`n[Create policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)"
+                Risk                 = 'High'
+                Name                 = 'CA policies block access from noncompliant devices'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'Medium'
+                Category             = 'Device security'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Track platform coverage
+        $PlatformCoverage = @{
+            'windows' = $false
+            'macOS'   = $false
+            'iOS'     = $false
+            'android' = $false
+        }
+        $AllPlatformsPolicy = $false
+
+        $PolicyDetails = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($policy in $CompliantDevicePolicies) {
+            $platforms = 'All platforms'
+
+            if ($policy.conditions.platforms.includePlatforms) {
+                if ($policy.conditions.platforms.includePlatforms -contains 'all') {
+                    $AllPlatformsPolicy = $true
+                    $platforms = 'All platforms'
+                } else {
+                    $platformList = $policy.conditions.platforms.includePlatforms -join ', '
+                    $platforms = $platformList
+
+                    # Track individual platform coverage
+                    foreach ($platform in $policy.conditions.platforms.includePlatforms) {
+                        $lowerPlatform = $platform.ToLower()
+                        if ($PlatformCoverage.ContainsKey($lowerPlatform)) {
+                            $PlatformCoverage[$lowerPlatform] = $true
+                        }
+                    }
+                }
+            } else {
+                # No platform filter = applies to all platforms
+                $AllPlatformsPolicy = $true
+            }
+
+            $PolicyDetails.Add([PSCustomObject]@{
+                    Name      = $policy.displayName
+                    Platforms = $platforms
+                })
+        }
+
+        # Check if all platforms are covered (either by a single policy or combination)
+        $AllCovered = $AllPlatformsPolicy -or (
+            $PlatformCoverage['windows'] -and
+            $PlatformCoverage['macOS'] -and
+            $PlatformCoverage['iOS'] -and
+            $PlatformCoverage['android']
+        )
+
+        $Status = if ($AllCovered) { 'Passed' } else { 'Failed' }
+
+        # Build result markdown
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: Conditional Access policies block noncompliant devices across all platforms.`n`n"
+        } else {
+            $ResultMarkdown = "❌ **Fail**: Conditional Access policies do not cover all device platforms.`n`n"
+            $missingPlatforms = [System.Collections.Generic.List[string]]::new()
+            foreach ($key in $PlatformCoverage.Keys) {
+                if (-not $PlatformCoverage[$key]) {
+                    $missingPlatforms.Add($key)
+                }
+            }
+            if ($missingPlatforms.Count -gt 0) {
+                $ResultMarkdown += "**Missing platform coverage**: $($missingPlatforms -join ', ')`n`n"
+            }
+        }
+
+        $ResultMarkdown += "## Compliant device policies`n`n"
+        $ResultMarkdown += "| Policy Name | Platforms |`n"
+        $ResultMarkdown += "| :---------- | :-------- |`n"
+
+        foreach ($detail in $PolicyDetails) {
+            $ResultMarkdown += "| $($detail.Name) | $($detail.Platforms) |`n"
+        }
+
+        $ResultMarkdown += "`n[Review policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)"
+
+        $TestParams = @{
+            TestId               = 'ZTNA24824'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'High'
+            Name                 = 'CA policies block access from noncompliant devices'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA24824'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'High'
+            Name                 = 'CA policies block access from noncompliant devices'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Device security'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA24824 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24827.ps1 b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24827.ps1
new file mode 100644
index 000000000000..70dff3d7135a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA24827.ps1
@@ -0,0 +1,186 @@
+function Invoke-CippTestZTNA24827 {
+    <#
+    .SYNOPSIS
+    Checks if Conditional Access policies block unmanaged mobile apps
+
+    .DESCRIPTION
+    Verifies that enabled Conditional Access policies exist that require compliant applications
+    for iOS and Android platforms, preventing unmanaged apps from accessing corporate data.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Tenant
+    )
+    #Tested - Device
+
+    try {
+        # Get CA policies from cache
+        $CAPolicies = New-CIPPDbRequest -TenantFilter $Tenant -Type 'ConditionalAccessPolicies'
+
+        if (-not $CAPolicies) {
+            $TestParams = @{
+                TestId               = 'ZTNA24827'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Skipped'
+                ResultMarkdown       = 'Unable to retrieve Conditional Access policies from cache.'
+                Risk                 = 'Medium'
+                Name                 = 'CA policies block unmanaged mobile apps'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'Medium'
+                Category             = 'Application security'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Filter for enabled policies with compliantApplication control for mobile platforms
+        $CompliantAppPolicies = [System.Collections.Generic.List[object]]::new()
+        foreach ($policy in $CAPolicies) {
+            if ($policy.state -eq 'enabled' -and
+                $policy.grantControls -and
+                $policy.grantControls.builtInControls -and
+                ($policy.grantControls.builtInControls -contains 'compliantApplication')) {
+
+                # Check if policy applies to iOS or Android
+                $appliesToMobile = $false
+                if ($policy.conditions.platforms.includePlatforms) {
+                    if ($policy.conditions.platforms.includePlatforms -contains 'all' -or
+                        $policy.conditions.platforms.includePlatforms -contains 'iOS' -or
+                        $policy.conditions.platforms.includePlatforms -contains 'android') {
+                        $appliesToMobile = $true
+                    }
+                } else {
+                    # No platform filter = applies to all platforms including mobile
+                    $appliesToMobile = $true
+                }
+
+                if ($appliesToMobile) {
+                    $CompliantAppPolicies.Add($policy)
+                }
+            }
+        }
+
+        if ($CompliantAppPolicies.Count -eq 0) {
+            $TestParams = @{
+                TestId               = 'ZTNA24827'
+                TenantFilter         = $Tenant
+                TestType             = 'ZeroTrustNetworkAccess'
+                Status               = 'Failed'
+                ResultMarkdown       = "❌ **Fail**: No Conditional Access policies found that block unmanaged mobile apps.`n`n[Create policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)"
+                Risk                 = 'Medium'
+                Name                 = 'CA policies block unmanaged mobile apps'
+                UserImpact           = 'Medium'
+                ImplementationEffort = 'Medium'
+                Category             = 'Application security'
+            }
+            Add-CippTestResult @TestParams
+            return
+        }
+
+        # Track platform coverage for iOS and Android
+        $PlatformCoverage = @{
+            'iOS'     = $false
+            'android' = $false
+        }
+        $AllPlatformsPolicy = $false
+
+        $PolicyDetails = [System.Collections.Generic.List[object]]::new()
+
+        foreach ($policy in $CompliantAppPolicies) {
+            $platforms = 'All platforms'
+
+            if ($policy.conditions.platforms.includePlatforms) {
+                if ($policy.conditions.platforms.includePlatforms -contains 'all') {
+                    $AllPlatformsPolicy = $true
+                    $platforms = 'All platforms'
+                } else {
+                    $platformList = $policy.conditions.platforms.includePlatforms -join ', '
+                    $platforms = $platformList
+
+                    # Track individual platform coverage
+                    if ($policy.conditions.platforms.includePlatforms -contains 'iOS') {
+                        $PlatformCoverage['iOS'] = $true
+                    }
+                    if ($policy.conditions.platforms.includePlatforms -contains 'android') {
+                        $PlatformCoverage['android'] = $true
+                    }
+                }
+            } else {
+                # No platform filter = applies to all platforms
+                $AllPlatformsPolicy = $true
+            }
+
+            $PolicyDetails.Add([PSCustomObject]@{
+                    Name      = $policy.displayName
+                    Platforms = $platforms
+                })
+        }
+
+        # Check if both iOS and Android are covered
+        $BothCovered = $AllPlatformsPolicy -or ($PlatformCoverage['iOS'] -and $PlatformCoverage['android'])
+
+        $Status = if ($BothCovered) { 'Passed' } else { 'Failed' }
+
+        # Build result markdown
+        if ($Status -eq 'Passed') {
+            $ResultMarkdown = "✅ **Pass**: Conditional Access policies block unmanaged apps on both iOS and Android platforms.`n`n"
+        } else {
+            $ResultMarkdown = "❌ **Fail**: Conditional Access policies do not cover all mobile platforms.`n`n"
+            $missingPlatforms = [System.Collections.Generic.List[string]]::new()
+            if (-not $PlatformCoverage['iOS']) {
+                $missingPlatforms.Add('iOS')
+            }
+            if (-not $PlatformCoverage['android']) {
+                $missingPlatforms.Add('android')
+            }
+            if ($missingPlatforms.Count -gt 0) {
+                $ResultMarkdown += "**Missing platform coverage**: $($missingPlatforms -join ', ')`n`n"
+            }
+        }
+
+        $ResultMarkdown += "## Compliant application policies`n`n"
+        $ResultMarkdown += "| Policy Name | Platforms |`n"
+        $ResultMarkdown += "| :---------- | :-------- |`n"
+
+        foreach ($detail in $PolicyDetails) {
+            $ResultMarkdown += "| $($detail.Name) | $($detail.Platforms) |`n"
+        }
+
+        $ResultMarkdown += "`n[Review policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies)"
+
+        $TestParams = @{
+            TestId               = 'ZTNA24827'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = $Status
+            ResultMarkdown       = $ResultMarkdown
+            Risk                 = 'Medium'
+            Name                 = 'CA policies block unmanaged mobile apps'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Application security'
+        }
+        Add-CippTestResult @TestParams
+
+    } catch {
+        $TestParams = @{
+            TestId               = 'ZTNA24827'
+            TenantFilter         = $Tenant
+            TestType             = 'ZeroTrustNetworkAccess'
+            Status               = 'Failed'
+            ResultMarkdown       = "❌ **Error**: $($_.Exception.Message)"
+            Risk                 = 'Medium'
+            Name                 = 'CA policies block unmanaged mobile apps'
+            UserImpact           = 'Medium'
+            ImplementationEffort = 'Medium'
+            Category             = 'Application security'
+        }
+        Add-CippTestResult @TestParams
+        Write-LogMessage -API 'ZeroTrustNetworkAccess' -tenant $Tenant -message "Test ZTNA24827 failed: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tests/ZTNA/report.json b/Modules/CIPPCore/Public/Tests/ZTNA/report.json
new file mode 100644
index 000000000000..21d37a9b0dd3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tests/ZTNA/report.json
@@ -0,0 +1,115 @@
+{
+  "name": "Zero Trust Network Access Tests",
+  "description": "Microsoft's Comprehensive security assessment covering identity and device compliance, conditional access policies, authentication methods, and endpoint protection aligned with Zero Trust principles.",
+  "version": "1.0",
+  "IdentityTests": [
+    "ZTNA21772",
+    "ZTNA21773",
+    "ZTNA21774",
+    "ZTNA21776",
+    "ZTNA21780",
+    "ZTNA21783",
+    "ZTNA21784",
+    "ZTNA21786",
+    "ZTNA21787",
+    "ZTNA21790",
+    "ZTNA21791",
+    "ZTNA21792",
+    "ZTNA21793",
+    "ZTNA21796",
+    "ZTNA21797",
+    "ZTNA21799",
+    "ZTNA21802",
+    "ZTNA21803",
+    "ZTNA21804",
+    "ZTNA21806",
+    "ZTNA21807",
+    "ZTNA21808",
+    "ZTNA21809",
+    "ZTNA21810",
+    "ZTNA21811",
+    "ZTNA21812",
+    "ZTNA21813",
+    "ZTNA21814",
+    "ZTNA21815",
+    "ZTNA21816",
+    "ZTNA21818",
+    "ZTNA21819",
+    "ZTNA21820",
+    "ZTNA21822",
+    "ZTNA21823",
+    "ZTNA21824",
+    "ZTNA21825",
+    "ZTNA21828",
+    "ZTNA21829",
+    "ZTNA21830",
+    "ZTNA21835",
+    "ZTNA21836",
+    "ZTNA21837",
+    "ZTNA21838",
+    "ZTNA21839",
+    "ZTNA21840",
+    "ZTNA21841",
+    "ZTNA21842",
+    "ZTNA21844",
+    "ZTNA21845",
+    "ZTNA21846",
+    "ZTNA21847",
+    "ZTNA21848",
+    "ZTNA21849",
+    "ZTNA21850",
+    "ZTNA21858",
+    "ZTNA21861",
+    "ZTNA21862",
+    "ZTNA21863",
+    "ZTNA21865",
+    "ZTNA21866",
+    "ZTNA21868",
+    "ZTNA21869",
+    "ZTNA21872",
+    "ZTNA21874",
+    "ZTNA21877",
+    "ZTNA21883",
+    "ZTNA21886",
+    "ZTNA21889",
+    "ZTNA21892",
+    "ZTNA21896",
+    "ZTNA21941",
+    "ZTNA21953",
+    "ZTNA21954",
+    "ZTNA21955",
+    "ZTNA21964",
+    "ZTNA21992",
+    "ZTNA22124",
+    "ZTNA22128",
+    "ZTNA22659",
+    "ZTNA24570",
+    "ZTNA24572",
+    "ZTNA24824",
+    "ZTNA24827"
+  ],
+  "DevicesTests": [
+    "ZTNA24540",
+    "ZTNA24541",
+    "ZTNA24542",
+    "ZTNA24543",
+    "ZTNA24545",
+    "ZTNA24547",
+    "ZTNA24548",
+    "ZTNA24549",
+    "ZTNA24550",
+    "ZTNA24552",
+    "ZTNA24553",
+    "ZTNA24560",
+    "ZTNA24564",
+    "ZTNA24568",
+    "ZTNA24569",
+    "ZTNA24574",
+    "ZTNA24575",
+    "ZTNA24576",
+    "ZTNA24784",
+    "ZTNA24839",
+    "ZTNA24840",
+    "ZTNA24870"
+  ]
+}
diff --git a/Modules/CippExtensions/Public/Extension Functions/Get-CippExtensionReportingData.ps1 b/Modules/CippExtensions/Public/Extension Functions/Get-CippExtensionReportingData.ps1
new file mode 100644
index 000000000000..894bb7a4469b
--- /dev/null
+++ b/Modules/CippExtensions/Public/Extension Functions/Get-CippExtensionReportingData.ps1	
@@ -0,0 +1,110 @@
+function Get-CippExtensionReportingData {
+    <#
+    .SYNOPSIS
+        Retrieves cached data from CIPP Reporting DB for extension sync
+
+    .DESCRIPTION
+        This function replaces Get-ExtensionCacheData by retrieving data from the new CIPP Reporting DB
+        instead of the legacy CacheExtensionSync table. It handles property mappings and data transformations
+        to maintain compatibility with existing extension sync code.
+
+    .PARAMETER TenantFilter
+        The tenant to retrieve data for
+
+    .PARAMETER IncludeMailboxes
+        Include mailbox data (requires separate cache run with Type 'Mailboxes')
+
+    .EXAMPLE
+        $ExtensionCache = Get-CippExtensionReportingData -TenantFilter 'contoso.onmicrosoft.com'
+
+    .EXAMPLE
+        $ExtensionCache = Get-CippExtensionReportingData -TenantFilter 'contoso.onmicrosoft.com' -IncludeMailboxes
+
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [switch]$IncludeMailboxes
+    )
+
+    try {
+        $Return = @{}
+
+        # Direct mappings - loop through items and parse each .Data property (filter out count entries)
+        $UsersItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Users' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.Users = if ($UsersItems) { $UsersItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        $DomainsItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Domains' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.Domains = if ($DomainsItems) { $DomainsItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        $ConditionalAccessItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.ConditionalAccess = if ($ConditionalAccessItems) { $ConditionalAccessItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        $ManagedDevicesItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'ManagedDevices' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.Devices = if ($ManagedDevicesItems) { $ManagedDevicesItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        $OrganizationItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Organization' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.Organization = if ($OrganizationItems) { ($OrganizationItems | ForEach-Object { $_.Data | ConvertFrom-Json } | Select-Object -First 1) } else { $null }
+
+        # Groups with inline members (members are now in each group object)
+        $GroupsItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Groups' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.Groups = if ($GroupsItems) { $GroupsItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        # Roles with inline members (members are now in each role object)
+        $RolesItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Roles' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.AllRoles = if ($RolesItems) { $RolesItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        # License mapping with property translation to maintain compatibility
+        $LicenseItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'LicenseOverview' | Where-Object { $_.RowKey -notlike '*-Count' }
+        if ($LicenseItems) {
+            $ParsedLicenseData = $LicenseItems | ForEach-Object { $_.Data | ConvertFrom-Json }
+            $Return.Licenses = $ParsedLicenseData | Select-Object @{N = 'skuId'; E = { $_.skuId } },
+            @{N = 'skuPartNumber'; E = { $_.skuPartNumber } },
+            @{N = 'consumedUnits'; E = { $_.CountUsed } },
+            @{N = 'prepaidUnits'; E = { @{enabled = $_.TotalLicenses } } }
+        } else {
+            $Return.Licenses = @()
+        }
+
+        # Intune policies (renamed from DeviceCompliancePolicies to IntuneDeviceCompliancePolicies)
+        $IntunePoliciesItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneDeviceCompliancePolicies' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.DeviceCompliancePolicies = if ($IntunePoliciesItems) { $IntunePoliciesItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        # Secure Score
+        $SecureScoreItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'SecureScore' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.SecureScore = if ($SecureScoreItems) { $SecureScoreItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        # Secure Score Control Profiles
+        $SecureScoreControlProfilesItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'SecureScoreControlProfiles' | Where-Object { $_.RowKey -notlike '*-Count' }
+        $Return.SecureScoreControlProfiles = if ($SecureScoreControlProfilesItems) { $SecureScoreControlProfilesItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+        # Mailboxes (optional - requires separate cache run)
+        if ($IncludeMailboxes) {
+            $MailboxesItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'Mailboxes' | Where-Object { $_.RowKey -notlike '*-Count' }
+            $Return.Mailboxes = if ($MailboxesItems) { $MailboxesItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+            $CASMailboxItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'CASMailbox' | Where-Object { $_.RowKey -notlike '*-Count' }
+            $Return.CASMailbox = if ($CASMailboxItems) { $CASMailboxItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+            $MailboxPermissionsItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailboxPermissions' | Where-Object { $_.RowKey -notlike '*-Count' }
+            $Return.MailboxPermissions = if ($MailboxPermissionsItems) { $MailboxPermissionsItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+            $OneDriveUsageItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'OneDriveUsage' | Where-Object { $_.RowKey -notlike '*-Count' }
+            $Return.OneDriveUsage = if ($OneDriveUsageItems) { $OneDriveUsageItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+
+            $MailboxUsageItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailboxUsage' | Where-Object { $_.RowKey -notlike '*-Count' }
+            $Return.MailboxUsage = if ($MailboxUsageItems) { $MailboxUsageItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
+        }
+
+        return $Return
+
+    } catch {
+        Write-LogMessage -API 'ExtensionCache' -tenant $TenantFilter -message "Failed to retrieve extension reporting data: $($_.Exception.Message)" -sev Error
+        throw
+    }
+}
diff --git a/Modules/CippExtensions/Public/Extension Functions/Get-ExtensionAPIKey.ps1 b/Modules/CippExtensions/Public/Extension Functions/Get-ExtensionAPIKey.ps1
index 5d85b9d5c54b..561893aee457 100644
--- a/Modules/CippExtensions/Public/Extension Functions/Get-ExtensionAPIKey.ps1	
+++ b/Modules/CippExtensions/Public/Extension Functions/Get-ExtensionAPIKey.ps1	
@@ -12,7 +12,7 @@ function Get-ExtensionAPIKey {
 
     $Var = "Ext_$Extension"
     $APIKey = Get-Item -Path "env:$Var" -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Value
-    if ($APIKey) {
+    if ($APIKey -and -not $Force) {
         Write-Information "Using cached API Key for $Extension"
     } else {
         Write-Information "Retrieving API Key for $Extension"
diff --git a/Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1 b/Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1
index bbb6c22e56c1..1cef75d498fe 100644
--- a/Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1	
+++ b/Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1	
@@ -16,6 +16,15 @@ function Register-CIPPExtensionScheduledTasks {
     $PushTasks = Get-CIPPAzDataTableEntity @ScheduledTasksTable -Filter 'Hidden eq true' | Where-Object { $_.Command -match 'Push-CippExtensionData' }
     $Tenants = Get-Tenants -IncludeErrors
 
+    # Remove all legacy Sync-CippExtensionData tasks (now deprecated - extensions use CippReportingDB)
+    Write-Information "Removing $($ScheduledTasks.Count) legacy Sync-CippExtensionData scheduled tasks"
+    foreach ($Task in $ScheduledTasks) {
+        Write-Information "Removing legacy task: $($Task.Name) for tenant $($Task.Tenant)"
+        $Entity = $Task | Select-Object -Property PartitionKey, RowKey
+        Remove-AzDataTableEntity -Force @ScheduledTasksTable -Entity $Entity
+    }
+    $ScheduledTasks = @() # Clear the list since we removed them all
+
     $MappedTenants = [System.Collections.Generic.List[string]]::new()
     foreach ($Extension in $Extensions) {
         $ExtensionConfig = $Config.$Extension
@@ -24,7 +33,7 @@ function Register-CIPPExtensionScheduledTasks {
                 $CustomDataMappingTable = Get-CIPPTable -TableName CustomDataMappings
                 $Mappings = Get-CIPPAzDataTableEntity @CustomDataMappingTable | ForEach-Object {
                     $Mapping = $_.JSON | ConvertFrom-Json
-                    if ($Mapping.sourceType.value -eq 'extensionSync') {
+                    if ($Mapping.sourceType.value -eq 'reportingDb' -or $Mapping.sourceType.value -eq 'extensionSync') {
                         $TenantMappings = if ($Mapping.tenantFilter.value -contains 'AllTenants') {
                             $Tenants
                         } else {
@@ -68,31 +77,9 @@ function Register-CIPPExtensionScheduledTasks {
                     continue
                 }
                 $MappedTenants.Add($Tenant.defaultDomainName)
-                foreach ($SyncType in $SyncTypes) {
-                    $ExistingTask = $ScheduledTasks | Where-Object { $_.Tenant -eq $Tenant.defaultDomainName -and $_.SyncType -eq $SyncType }
-                    if (!$ExistingTask) {
-                        $unixtime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
-                        $Task = [pscustomobject]@{
-                            Name          = "Extension Sync - $SyncType"
-                            Command       = @{
-                                value = 'Sync-CippExtensionData'
-                                label = 'Sync-CippExtensionData'
-                            }
-                            Parameters    = [pscustomobject]@{
-                                TenantFilter = $Tenant.defaultDomainName
-                                SyncType     = $SyncType
-                            }
-                            Recurrence    = '1d'
-                            ScheduledTime = $unixtime
-                            TenantFilter  = $Tenant.defaultDomainName
-                        }
-                        if ($ExistingTask) {
-                            $Task | Add-Member -NotePropertyName 'RowKey' -NotePropertyValue $ExistingTask.RowKey -Force
-                        }
-                        $null = Add-CIPPScheduledTask -Task $Task -hidden $true -SyncType $SyncType
-                        Write-Information "Creating $SyncType task for tenant $($Tenant.defaultDomainName)"
-                    }
-                }
+                
+                # Legacy Sync-CippExtensionData tasks are no longer needed - extensions now use CippReportingDB
+                # All cache data is now collected by Push-CIPPDBCacheData scheduled tasks
 
                 $ExistingPushTask = $PushTasks | Where-Object { $_.Tenant -eq $Tenant.defaultDomainName -and $_.SyncType -eq $Extension }
                 if ((!$ExistingPushTask -or $Reschedule.IsPresent) -and $Extension -ne 'NinjaOne') {
diff --git a/Modules/CippExtensions/Public/Extension Functions/Sync-CippExtensionData.ps1 b/Modules/CippExtensions/Public/Extension Functions/Sync-CippExtensionData.ps1
index 3ddeb244de00..480717d693bd 100644
--- a/Modules/CippExtensions/Public/Extension Functions/Sync-CippExtensionData.ps1	
+++ b/Modules/CippExtensions/Public/Extension Functions/Sync-CippExtensionData.ps1	
@@ -9,6 +9,10 @@ function Sync-CippExtensionData {
         $SyncType
     )
 
+    # Legacy cache system is deprecated - all extensions now use CippReportingDB
+    Write-Warning "Sync-CippExtensionData is deprecated. This scheduled task should be removed. Extensions now use Push-CIPPDBCacheData and Get-CippExtensionReportingData."
+    return
+
     $Table = Get-CIPPTable -TableName ExtensionSync
     $Extensions = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$($SyncType)'"
     $LastSync = $Extensions | Where-Object { $_.RowKey -eq $TenantFilter }
diff --git a/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1 b/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1
index 867c6fd8082e..19b1e8c13def 100644
--- a/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1
+++ b/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1
@@ -44,8 +44,9 @@ function Invoke-HuduExtensionSync {
         $CIPPURL = 'https://{0}' -f $Config.Value
         $EnableCIPP = $true
 
-        # Get Hudu Extension Cache
-        $ExtensionCache = Get-ExtensionCacheData -TenantFilter $Tenant.defaultDomainName
+        # Get CIPP Extension Reporting Data (from new CippReportingDB)
+        # Include mailboxes if needed for Hudu sync
+        $ExtensionCache = Get-CippExtensionReportingData -TenantFilter $Tenant.defaultDomainName -IncludeMailboxes
         $company_id = $TenantMap.IntegrationId
 
         # If tenant not found in mapping table, return error
@@ -166,8 +167,8 @@ function Invoke-HuduExtensionSync {
 
 
         $Roles = foreach ($Role in $AllRoles) {
-            # Get members from cache
-            $Members = ($ExtensionCache."AllRoles_$($Role.id)")
+            # Members are now inline with each role object
+            $Members = $Role.members
             [PSCustomObject]@{
                 ID            = $Role.id
                 DisplayName   = $Role.displayName
@@ -254,7 +255,9 @@ function Invoke-HuduExtensionSync {
         $DeviceCompliancePolicies = $ExtensionCache.DeviceCompliancePolicies
 
         $DeviceComplianceDetails = foreach ($Policy in $DeviceCompliancePolicies) {
-            $DeviceStatuses = $ExtensionCache."DeviceCompliancePolicies_$($Policy.id)"
+            # Device statuses are cached per policy with new naming: IntuneDeviceCompliancePolicies_{policyId}
+            $DeviceStatusItems = Get-CIPPDbItem -TenantFilter $TenantFilter -Type "IntuneDeviceCompliancePolicies_$($Policy.id)" | Where-Object { $_.RowKey -notlike '*-Count' }
+            $DeviceStatuses = if ($DeviceStatusItems) { $DeviceStatusItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
             [pscustomobject]@{
                 ID             = $Policy.id
                 DisplayName    = $Policy.displayName
@@ -265,7 +268,8 @@ function Invoke-HuduExtensionSync {
         $AllGroups = $ExtensionCache.Groups
 
         $Groups = foreach ($Group in $AllGroups) {
-            $Members = $ExtensionCache."Groups_$($Group.id)"
+            # Members are now inline with each group object
+            $Members = $Group.members
             [pscustomobject]@{
                 ID          = $Group.id
                 DisplayName = $Group.displayName
diff --git a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1
index c5f16239f905..7d2b1a4b9aab 100644
--- a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1
+++ b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1
@@ -287,7 +287,7 @@ function Invoke-NinjaOneTenantSync {
         [System.Collections.Generic.List[PSCustomObject]]$NinjaLicenseCreation = @()
 
         # Replace direct Graph/Exchange calls with cached data
-        $ExtensionCache = Get-ExtensionCacheData -TenantFilter $Customer.defaultDomainName
+        $ExtensionCache = Get-CippExtensionReportingData -TenantFilter $Customer.defaultDomainName -IncludeMailboxes
 
         # Map cached data to variables
         $Users = $ExtensionCache.Users
@@ -301,9 +301,9 @@ function Invoke-NinjaOneTenantSync {
         $MailboxStatsFull = $ExtensionCache.MailboxUsage
         $Permissions = $ExtensionCache.MailboxPermissions
         $SecureScore = $ExtensionCache.SecureScore
-        $Subscriptions = $ExtensionCache.Subscriptions
+        $Subscriptions = if ($ExtensionCache.Licenses) { $ExtensionCache.Licenses.TermInfo | Where-Object { $null -ne $_ } } else { @() }
         $SecureScoreProfiles = $ExtensionCache.SecureScoreControlProfiles
-        $TenantDetails = $ExtensionCache.TenantDetails
+        $TenantDetails = $ExtensionCache.Organization
         $RawDomains = $ExtensionCache.Domains
         $AllGroups = $ExtensionCache.Groups
         $Licenses = $ExtensionCache.Licenses
@@ -337,14 +337,14 @@ function Invoke-NinjaOneTenantSync {
         $licensedUsers = $Users | Where-Object { $null -ne $_.AssignedLicenses.SkuId } | Sort-Object UserPrincipalName
 
         $Roles = foreach ($Role in $AllRoles) {
-            # Get members from cache
-            $Members = ($ExtensionCache."AllRoles_$($Role.id)")
+            # Get members from inline property (no longer separate cache entries)
+            $Members = $Role.members
             [PSCustomObject]@{
-                ID            = $Result.id
+                ID            = $Role.id
                 DisplayName   = $Role.displayName
                 Description   = $Role.description
                 Members       = $Members
-                ParsedMembers = $Members.displayName -join ', '
+                ParsedMembers = if ($Members) { $Members.displayName -join ', ' } else { '' }
             }
         }
 
@@ -364,7 +364,8 @@ function Invoke-NinjaOneTenantSync {
         Write-Verbose "$(Get-Date) - Parsing Device Compliance Policies"
 
         $DeviceComplianceDetails = foreach ($Policy in $DeviceCompliancePolicies) {
-            $DeviceStatuses = $ExtensionCache."DeviceCompliancePolicy_$($Policy.id)"
+            $StatusItems = Get-CIPPDbItem -TenantFilter $Customer.defaultDomainName -Type "IntuneDeviceCompliancePolicies_$($Policy.id)" | Where-Object { $_.RowKey -notlike '*-Count' }
+            $DeviceStatuses = if ($StatusItems) { $StatusItems | ForEach-Object { $_.Data | ConvertFrom-Json } } else { @() }
             [pscustomobject]@{
                 ID             = $Policy.id
                 DisplayName    = $Policy.displayName
@@ -375,7 +376,8 @@ function Invoke-NinjaOneTenantSync {
         Write-Verbose "$(Get-Date) - Parsing Groups"
 
         $Groups = foreach ($Group in $AllGroups) {
-            $Members = $ExtensionCache."Groups_$($Result.id)"
+            # Get members from inline property (no longer separate cache entries)
+            $Members = $Group.members
             [pscustomobject]@{
                 ID          = $Group.id
                 DisplayName = $Group.displayName
diff --git a/Test-AllZTNATests.ps1 b/Test-AllZTNATests.ps1
new file mode 100644
index 000000000000..8c371e090854
--- /dev/null
+++ b/Test-AllZTNATests.ps1
@@ -0,0 +1,9 @@
+$Tenant = '7ngn50.onmicrosoft.com'
+$item =0
+Get-ChildItem -Path 'C:\Github\CIPP-API\Modules\CIPPCore\Public\Tests' -Recurse -Filter 'Invoke-CippTest*.ps1'| ForEach-Object {
+    $item++
+
+    write-host "performing test $($_.BaseName) - $($item)"
+    . $_.FullName; & $_.BaseName -Tenant $Tenant
+
+}
diff --git a/Tests/Alerts/Get-CIPPAlertIntunePolicyConflicts.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertIntunePolicyConflicts.Tests.ps1
new file mode 100644
index 000000000000..e37958e93814
--- /dev/null
+++ b/Tests/Alerts/Get-CIPPAlertIntunePolicyConflicts.Tests.ps1
@@ -0,0 +1,155 @@
+# Pester tests for Get-CIPPAlertIntunePolicyConflicts
+# Verifies aggregation defaults, toggles, and error handling
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $AlertPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1'
+
+    function New-GraphGetRequest { param($uri, $tenantid) }
+    function Write-AlertTrace { param($cmdletName, $tenantFilter, $data) }
+    function Write-AlertMessage { param($tenant, $message) }
+    function Get-NormalizedError { param($message) $message }
+    function Test-CIPPStandardLicense { param($StandardName, $TenantFilter, $RequiredCapabilities) }
+
+    . $AlertPath
+}
+
+Describe 'Get-CIPPAlertIntunePolicyConflicts' {
+    BeforeEach {
+        $script:CapturedData = $null
+        $script:CapturedTenant = $null
+        $script:CapturedErrorMessage = $null
+
+        Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
+
+        Mock -CommandName Write-AlertTrace -MockWith {
+            param($cmdletName, $tenantFilter, $data)
+            $script:CapturedData = $data
+            $script:CapturedTenant = $tenantFilter
+        }
+
+        Mock -CommandName Write-AlertMessage -MockWith {
+            param($tenant, $message)
+            $script:CapturedErrorMessage = $message
+        }
+
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            param($uri, $tenantid)
+            if ($uri -like '*deviceManagement/managedDevices*') {
+                @(
+                    [pscustomobject]@{
+                        deviceName               = 'PC-01'
+                        userPrincipalName        = 'user1@contoso.com'
+                        id                       = 'device-1'
+                        deviceConfigurationStates = @(
+                            [pscustomobject]@{ displayName = 'Policy A'; state = 'conflict' }
+                        )
+                    }
+                )
+            } elseif ($uri -like '*deviceAppManagement/mobileApps*') {
+                @(
+                    [pscustomobject]@{
+                        displayName   = 'App A'
+                        deviceStatuses = @(
+                            [pscustomobject]@{ installState = 'error'; deviceName = 'PC-01'; userPrincipalName = 'user1@contoso.com'; deviceId = 'device-1' }
+                        )
+                    }
+                )
+            }
+        }
+    }
+
+    It 'defaults to aggregated alerting with all mechanisms and statuses' {
+        Get-CIPPAlertIntunePolicyConflicts -TenantFilter 'contoso.onmicrosoft.com'
+
+        $CapturedTenant | Should -Be 'contoso.onmicrosoft.com'
+        $CapturedData | Should -Not -BeNullOrEmpty
+        $CapturedData.Count | Should -Be 1
+        $CapturedData[0].PolicyIssues | Should -Be 1
+        $CapturedData[0].AppIssues | Should -Be 1
+        $CapturedData[0].Issues.Count | Should -Be 2
+    }
+
+    It 'emits per-issue alerts when AlertEachIssue is true' {
+        Get-CIPPAlertIntunePolicyConflicts -TenantFilter 'contoso.onmicrosoft.com' -InputValue @{ AlertEachIssue = $true }
+
+        $CapturedData | Should -Not -BeNullOrEmpty
+        $CapturedData.Count | Should -Be 2
+        ($CapturedData | Where-Object { $_.Type -eq 'Policy' }).Count | Should -Be 1
+        ($CapturedData | Where-Object { $_.Type -eq 'Application' }).Count | Should -Be 1
+    }
+
+    It 'supports legacy Aggregate=false for per-issue alerts' {
+        Get-CIPPAlertIntunePolicyConflicts -TenantFilter 'contoso.onmicrosoft.com' -InputValue @{ Aggregate = $false }
+
+        $CapturedData | Should -Not -BeNullOrEmpty
+        $CapturedData.Count | Should -Be 2
+        ($CapturedData | Where-Object { $_.Type -eq 'Policy' }).Count | Should -Be 1
+        ($CapturedData | Where-Object { $_.Type -eq 'Application' }).Count | Should -Be 1
+    }
+
+    It 'honors IncludePolicies toggle' {
+        Get-CIPPAlertIntunePolicyConflicts -TenantFilter 'contoso.onmicrosoft.com' -InputValue @{ IncludePolicies = $false }
+
+        $CapturedData | Should -Not -BeNullOrEmpty
+        $CapturedData.Count | Should -Be 1
+        $CapturedData[0].PolicyIssues | Should -Be 0
+        $CapturedData[0].AppIssues | Should -Be 1
+        $CapturedData[0].Issues.Count | Should -Be 1
+        ($CapturedData[0].Issues | Where-Object { $_.Type -eq 'Policy' }).Count | Should -Be 0
+    }
+
+    It 'suppresses conflict-only alerts when AlertConflicts is false' {
+        # conflict for policy, error for app; expect only app when conflicts suppressed
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            param($uri, $tenantid)
+            if ($uri -like '*deviceManagement/managedDevices*') {
+                @(
+                    [pscustomobject]@{
+                        deviceName               = 'PC-02'
+                        userPrincipalName        = 'user2@contoso.com'
+                        id                       = 'device-2'
+                        deviceConfigurationStates = @(
+                            [pscustomobject]@{ displayName = 'Policy B'; state = 'conflict' }
+                        )
+                    }
+                )
+            } elseif ($uri -like '*deviceAppManagement/mobileApps*') {
+                @(
+                    [pscustomobject]@{
+                        displayName   = 'App B'
+                        deviceStatuses = @(
+                            [pscustomobject]@{ installState = 'error'; deviceName = 'PC-02'; userPrincipalName = 'user2@contoso.com'; deviceId = 'device-2' }
+                        )
+                    }
+                )
+            }
+        }
+
+        Get-CIPPAlertIntunePolicyConflicts -TenantFilter 'contoso.onmicrosoft.com' -InputValue @{ AlertConflicts = $false; Aggregate = $false }
+
+        $CapturedData | Should -Not -BeNullOrEmpty
+        $CapturedData.Count | Should -Be 1
+        $CapturedData[0].Type | Should -Be 'Application'
+        $CapturedData[0].IssueStatus | Should -Be 'error'
+    }
+
+    It 'skips processing when license check fails' {
+        Mock -CommandName Test-CIPPStandardLicense -MockWith { $false } -Verifiable
+
+        Get-CIPPAlertIntunePolicyConflicts -TenantFilter 'contoso.onmicrosoft.com'
+
+        $CapturedData | Should -BeNullOrEmpty
+        $CapturedTenant | Should -BeNullOrEmpty
+    }
+
+    It 'writes alert message when Graph call fails' {
+        Mock -CommandName New-GraphGetRequest -MockWith { throw 'Graph failure' } -Verifiable
+
+        Get-CIPPAlertIntunePolicyConflicts -TenantFilter 'contoso.onmicrosoft.com'
+
+        $CapturedData | Should -BeNullOrEmpty
+        $CapturedErrorMessage | Should -Match 'Failed to query Intune (policy|application) states'
+        $CapturedErrorMessage | Should -Match 'Graph failure'
+    }
+}
diff --git a/Tools/Test-BackupStorageComparison.ps1 b/Tools/Test-BackupStorageComparison.ps1
new file mode 100644
index 000000000000..ea14bd8a94bf
--- /dev/null
+++ b/Tools/Test-BackupStorageComparison.ps1
@@ -0,0 +1,249 @@
+param(
+    [Parameter(Mandatory = $false)] [string] $ConnectionString = $env:AzureWebJobsStorage,
+    [Parameter(Mandatory = $false)] [ValidateSet('Small', 'Medium', 'Large', 'All')] [string] $TestSize = 'All',
+    [Parameter(Mandatory = $false)] [bool] $Cleanup = $true
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Import CIPPCore module from repository
+$modulePath = Join-Path $PSScriptRoot '..' 'Modules' 'CIPPCore' 'CIPPCore.psm1'
+if (-not (Test-Path -LiteralPath $modulePath)) {
+    throw "CIPPCore module not found at $modulePath"
+}
+Import-Module -Force $modulePath
+
+if (-not $ConnectionString) {
+    throw 'Azure Storage connection string not provided. Set AzureWebJobsStorage or pass -ConnectionString.'
+}
+
+Write-Host '================================' -ForegroundColor Cyan
+Write-Host 'Backup Storage Comparison Tests' -ForegroundColor Cyan
+Write-Host '================================' -ForegroundColor Cyan
+
+# Test data configurations
+$testConfigs = @(
+    @{
+        Name              = 'Small'
+        ItemCount         = 10
+        PropertiesPerItem = 5
+        Description       = 'Small payload (~5KB)'
+    },
+    @{
+        Name              = 'Medium'
+        ItemCount         = 100
+        PropertiesPerItem = 15
+        Description       = 'Medium payload (~250KB)'
+    },
+    @{
+        Name              = 'Large'
+        ItemCount         = 500
+        PropertiesPerItem = 30
+        Description       = 'Large payload (~2.5MB)'
+    }
+)
+
+function Generate-TestData {
+    param(
+        [int]$ItemCount,
+        [int]$PropertiesPerItem,
+        [string]$Type
+    )
+
+    $data = @()
+    for ($i = 0; $i -lt $ItemCount; $i++) {
+        $item = @{
+            id        = [guid]::NewGuid().ToString()
+            rowKey    = "item_$i"
+            timestamp = (Get-Date).ToUniversalTime()
+            table     = $Type
+        }
+
+        for ($p = 0; $p -lt $PropertiesPerItem; $p++) {
+            $item["property_$p"] = "This is test property $p with some additional content to make it realistic. Lorem ipsum dolor sit amet." * 3
+        }
+
+        $data += $item
+    }
+
+    return $data
+}
+
+function Test-TableStorage {
+    param(
+        [array]$TestData,
+        [string]$TestName
+    )
+
+    Write-Host "`n[TABLE STORAGE] Testing $TestName..." -ForegroundColor Yellow
+
+    $tableName = "TestBackup$(Get-Random -Maximum 100000)"
+    $Table = Get-CippTable -tablename $tableName
+
+    $jsonString = $TestData | ConvertTo-Json -Depth 100 -Compress
+    $jsonSizeKB = [math]::Round(($jsonString | Measure-Object -Character).Characters / 1KB, 2)
+
+    Write-Host "  JSON Size: $jsonSizeKB KB"
+
+    # Time the storage operation
+    $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
+    try {
+        $entity = @{
+            PartitionKey = 'TestBackup'
+            RowKey       = $TestName
+            Backup       = [string]$jsonString
+        }
+        Add-CIPPAzDataTableEntity @Table -Entity $entity -Force -ErrorAction Stop
+        $stopwatch.Stop()
+
+        Write-Host "  Write Time: $($stopwatch.ElapsedMilliseconds)ms" -ForegroundColor Green
+        Write-Host '  Status: Success ✓' -ForegroundColor Green
+
+        return @{
+            Method    = 'Table Storage'
+            TestName  = $TestName
+            Size      = $jsonSizeKB
+            WriteTime = $stopwatch.ElapsedMilliseconds
+            Success   = $true
+            Details   = "Stored in table '$tableName'"
+        }
+    } catch {
+        $stopwatch.Stop()
+        Write-Host "  Status: Failed ✗ - $($_.Exception.Message)" -ForegroundColor Red
+
+        return @{
+            Method    = 'Table Storage'
+            TestName  = $TestName
+            Size      = $jsonSizeKB
+            WriteTime = $stopwatch.ElapsedMilliseconds
+            Success   = $false
+            Details   = $_.Exception.Message
+        }
+    }
+}
+
+function Test-BlobStorage {
+    param(
+        [array]$TestData,
+        [string]$TestName
+    )
+
+    Write-Host "`n[BLOB STORAGE] Testing $TestName..." -ForegroundColor Yellow
+
+    $containerName = 'test-backup-comparison'
+    $blobName = "backup_$TestName`_$(Get-Random -Maximum 100000).json"
+
+    $jsonString = $TestData | ConvertTo-Json -Depth 100 -Compress
+    $jsonSizeKB = [math]::Round(($jsonString | Measure-Object -Character).Characters / 1KB, 2)
+
+    Write-Host "  JSON Size: $jsonSizeKB KB"
+
+    try {
+        # Ensure container exists
+        $containers = @()
+        try {
+            $containers = New-CIPPAzStorageRequest -Service 'blob' -Component 'list' -ConnectionString $ConnectionString
+        } catch { $containers = @() }
+
+        $exists = ($containers | Where-Object { $_.Name -eq $containerName }) -ne $null
+        if (-not $exists) {
+            Write-Host "  Creating container '$containerName'..." -ForegroundColor Gray
+            $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $containerName -Method 'PUT' -QueryParams @{ restype = 'container' } -ConnectionString $ConnectionString
+            Start-Sleep -Milliseconds 500
+        }
+
+        # Time the upload operation
+        $stopwatch = [System.Diagnostics.Stopwatch]::StartNew()
+        $null = New-CIPPAzStorageRequest -Service 'blob' -Resource "$containerName/$blobName" -Method 'PUT' -ContentType 'application/json; charset=utf-8' -Body $jsonString -ConnectionString $ConnectionString
+        $stopwatch.Stop()
+
+        Write-Host "  Write Time: $($stopwatch.ElapsedMilliseconds)ms" -ForegroundColor Green
+        Write-Host '  Status: Success ✓' -ForegroundColor Green
+        Write-Host "  Location: $containerName/$blobName" -ForegroundColor Gray
+
+        return @{
+            Method    = 'Blob Storage'
+            TestName  = $TestName
+            Size      = $jsonSizeKB
+            WriteTime = $stopwatch.ElapsedMilliseconds
+            Success   = $true
+            Details   = "$containerName/$blobName"
+        }
+    } catch {
+        $stopwatch.Stop()
+        Write-Host "  Status: Failed ✗ - $($_.Exception.Message)" -ForegroundColor Red
+
+        return @{
+            Method    = 'Blob Storage'
+            TestName  = $TestName
+            Size      = $jsonSizeKB
+            WriteTime = $stopwatch.ElapsedMilliseconds
+            Success   = $false
+            Details   = $_.Exception.Message
+        }
+    }
+}
+
+# Run tests
+$results = @()
+$configsToRun = if ($TestSize -eq 'All') { $testConfigs } else { $testConfigs | Where-Object { $_.Name -eq $TestSize } }
+
+foreach ($config in $configsToRun) {
+    Write-Host "`n`n$($config.Description)" -ForegroundColor Magenta
+    Write-Host "Generating test data ($($config.ItemCount) items, $($config.PropertiesPerItem) properties)..." -ForegroundColor Gray
+
+    $testData = Generate-TestData -ItemCount $config.ItemCount -PropertiesPerItem $config.PropertiesPerItem -Type "Backup_$($config.Name)"
+
+    # Test table storage
+    $tableResult = Test-TableStorage -TestData $testData -TestName $config.Name
+    $results += $tableResult
+
+    Start-Sleep -Milliseconds 500
+
+    # Test blob storage
+    $blobResult = Test-BlobStorage -TestData $testData -TestName $config.Name
+    $results += $blobResult
+}
+
+# Summary
+Write-Host "`n`n================================" -ForegroundColor Cyan
+Write-Host 'Test Summary' -ForegroundColor Cyan
+Write-Host '================================' -ForegroundColor Cyan
+
+$results | Group-Object -Property TestName | ForEach-Object {
+    $testGroup = $_
+    Write-Host "`n$($testGroup.Name):" -ForegroundColor Magenta
+
+    $testGroup.Group | ForEach-Object {
+        $status = if ($_.Success) { '✓' } else { '✗' }
+        Write-Host "  $($_.Method): $($_.Size)KB | Write: $($_.WriteTime)ms | $status" -ForegroundColor $(if ($_.Success) { 'Green' } else { 'Red' })
+    }
+}
+
+# Detailed comparison
+Write-Host "`n`n================================" -ForegroundColor Cyan
+Write-Host 'Performance Comparison' -ForegroundColor Cyan
+Write-Host '================================' -ForegroundColor Cyan
+
+$results | Group-Object -Property TestName | ForEach-Object {
+    $testGroup = $_
+    $tableResult = $testGroup.Group | Where-Object { $_.Method -eq 'Table Storage' }
+    $blobResult = $testGroup.Group | Where-Object { $_.Method -eq 'Blob Storage' }
+
+    if ($tableResult -and $blobResult -and $tableResult.Success -and $blobResult.Success) {
+        $timeDiff = $blobResult.WriteTime - $tableResult.WriteTime
+        $timePercentage = [math]::Round(($timeDiff / $tableResult.WriteTime) * 100, 2)
+
+        Write-Host "`n$($testGroup.Name):" -ForegroundColor Magenta
+        Write-Host "  Table Write Time: $($tableResult.WriteTime)ms" -ForegroundColor Gray
+        Write-Host "  Blob Write Time:  $($blobResult.WriteTime)ms" -ForegroundColor Gray
+
+        if ($timeDiff -gt 0) {
+            Write-Host "  Blob is $($timeDiff)ms slower ($($timePercentage)% slower)" -ForegroundColor Yellow
+        } else {
+            Write-Host "  Blob is $((-$timeDiff))ms faster ($($(-$timePercentage))% faster)" -ForegroundColor Green
+        }
+    }
+}
+
+Write-Host "`n`nTest Complete!" -ForegroundColor Green
diff --git a/Tools/Test-BlobUpload.ps1 b/Tools/Test-BlobUpload.ps1
new file mode 100644
index 000000000000..f7a13eeb6a55
--- /dev/null
+++ b/Tools/Test-BlobUpload.ps1
@@ -0,0 +1,85 @@
+param(
+    [Parameter(Mandatory = $false)] [string] $ContainerName = 'test',
+    [Parameter(Mandatory = $false)] [string] $BlobName = 'hello.txt',
+    [Parameter(Mandatory = $false)] [string] $Content = 'Hello, world!',
+    [Parameter(Mandatory = $false)] [string] $ConnectionString = $env:AzureWebJobsStorage
+)
+
+$ErrorActionPreference = 'Stop'
+
+# Import CIPPCore module from repository
+$modulePath = Join-Path $PSScriptRoot '..' 'Modules' 'CIPPCore' 'CIPPCore.psm1'
+if (-not (Test-Path -LiteralPath $modulePath)) {
+    throw "CIPPCore module not found at $modulePath"
+}
+Import-Module -Force $modulePath
+
+if (-not $ConnectionString) {
+    throw 'Azure Storage connection string not provided. Set AzureWebJobsStorage or pass -ConnectionString.'
+}
+
+# Parse connection string for AccountName and AccountKey
+$connectionParams = @{}
+foreach ($part in ($ConnectionString -split ';')) {
+    $p = $part.Trim()
+    if ($p -and $p -match '^(.+?)=(.+)$') { $connectionParams[$matches[1]] = $matches[2] }
+}
+$AccountName = $connectionParams['AccountName']
+$AccountKey = $connectionParams['AccountKey']
+
+# Support UseDevelopmentStorage=true
+if ($connectionParams['UseDevelopmentStorage'] -eq 'true') {
+    $AccountName = 'devstoreaccount1'
+    $AccountKey = 'Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw=='
+}
+
+if (-not $AccountName -or -not $AccountKey) {
+    throw 'Connection string must contain AccountName and AccountKey or UseDevelopmentStorage=true.'
+}
+
+Write-Host "Account: $AccountName" -ForegroundColor Cyan
+Write-Host "Container: $ContainerName" -ForegroundColor Cyan
+Write-Host "Blob: $BlobName" -ForegroundColor Cyan
+
+# Check if container exists via listing; create if missing
+$containers = @()
+try {
+    $containers = New-CIPPAzStorageRequest -Service 'blob' -Component 'list'
+} catch { $containers = @() }
+
+$exists = ($containers | Where-Object { $_.Name -eq $ContainerName }) -ne $null
+if ($exists) {
+    Write-Host 'Container exists.' -ForegroundColor Green
+} else {
+    Write-Host 'Container not found. Creating...' -ForegroundColor Yellow
+    $null = New-CIPPAzStorageRequest -Service 'blob' -Resource $ContainerName -Method 'PUT' -QueryParams @{ restype = 'container' }
+    Start-Sleep -Seconds 1
+    # Re-check
+    try {
+        $containers = New-CIPPAzStorageRequest -Service 'blob' -Component 'list'
+    } catch { $containers = @() }
+    $exists = ($containers | Where-Object { $_.Name -eq $ContainerName }) -ne $null
+    if (-not $exists) { throw "Failed to create container '$ContainerName'" }
+    Write-Host 'Container created.' -ForegroundColor Green
+}
+
+# Upload blob content (BlockBlob by default)
+Write-Host 'Uploading blob content...' -ForegroundColor Yellow
+try {
+    $null = New-CIPPAzStorageRequest -Service 'blob' -Resource "$ContainerName/$BlobName" -Method 'PUT' -ContentType 'text/plain; charset=utf-8' -Body $Content
+} catch {
+    Write-Error "Blob upload failed: $($_.Exception.Message)"
+    throw
+}
+Write-Host 'Upload complete.' -ForegroundColor Green
+
+# Generate SAS token valid for 7 days (read-only)
+$expiry = (Get-Date).ToUniversalTime().AddDays(7)
+$sas = New-CIPPAzServiceSAS -AccountName $AccountName -AccountKey $AccountKey -Service 'blob' -ResourcePath "$ContainerName/$BlobName" -Permissions 'r' -ExpiryTime $expiry -Protocol 'https' -Version '2022-11-02' -SignedResource 'b' -ConnectionString $ConnectionString
+
+$url = $sas.ResourceUri + $sas.Token
+Write-Host 'Download URL (7 days):' -ForegroundColor Cyan
+Write-Output $url
+
+# Return structured object
+[PSCustomObject]@{ Url = $url; Container = $ContainerName; Blob = $BlobName; ExpiresUtc = $expiry }
diff --git a/host.json b/host.json
index 0e7bc9b1617d..ec9e853f1eed 100644
--- a/host.json
+++ b/host.json
@@ -16,7 +16,7 @@
         "distributedTracingEnabled": false,
         "version": "None"
       },
-      "defaultVersion": "8.8.2",
+      "defaultVersion": "10.0.1",
       "versionMatchStrategy": "Strict",
       "versionFailureStrategy": "Fail"
     }
diff --git a/test-alignment-profile.ps1 b/test-alignment-profile.ps1
deleted file mode 100644
index 5ca11bf50fd3..000000000000
--- a/test-alignment-profile.ps1
+++ /dev/null
@@ -1,30 +0,0 @@
-# Test script for Get-CIPPTenantAlignment with profiling
-# This will verify the function returns data in the same format
-
-# Import the module
-Import-Module "$PSScriptRoot\Modules\CIPPCore" -Force
-
-# Test with a single tenant
-$TestTenant = 'm365x72497814.onmicrosoft.com' # Replace with a valid test tenant
-
-Write-Host "Testing Get-CIPPTenantAlignment with profiling..." -ForegroundColor Cyan
-Write-Host "Tenant: $TestTenant" -ForegroundColor Yellow
-
-try {
-    $Result = Get-CIPPTenantAlignment -TenantFilter $TestTenant
-    
-    Write-Host "`nResult Count: $($Result.Count)" -ForegroundColor Green
-    
-    if ($Result) {
-        Write-Host "`nFirst Result Properties:" -ForegroundColor Green
-        $Result[0] | Get-Member -MemberType Properties | Select-Object Name, Definition
-        
-        Write-Host "`nFirst Result Data:" -ForegroundColor Green
-        $Result[0] | ConvertTo-Json -Depth 2
-    } else {
-        Write-Host "No results returned" -ForegroundColor Yellow
-    }
-} catch {
-    Write-Host "Error: $_" -ForegroundColor Red
-    Write-Host $_.ScriptStackTrace -ForegroundColor Red
-}
diff --git a/version_latest.txt b/version_latest.txt
index 11f1d47dac93..1532420512a9 100644
--- a/version_latest.txt
+++ b/version_latest.txt
@@ -1 +1 @@
-8.8.2
+10.0.1
diff --git a/yarn.lock b/yarn.lock
new file mode 100644
index 000000000000..fb57ccd13afb
--- /dev/null
+++ b/yarn.lock
@@ -0,0 +1,4 @@
+# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+# yarn lockfile v1
+
+