starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-25 08:16:01 +03:00

[GH-ISSUE #4392] [Bug]: Vacation Mode Inconsistent with Additions and Removals #1996

New issue

Closed

opened 2026-03-02 13:48:48 +03:00 by kerem · 4 comments

kerem commented

2026-03-02 13:48:48 +03:00

Owner

Originally created by @theknoxtech on GitHub (Jul 2, 2025).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/4392

Originally assigned to: @JohnDuprey on GitHub.

Required confirmations before submitting

I can reproduce this issue on the latest released versions of both CIPP and CIPP-API.
I have searched existing issues (both open and closed) to avoid duplicates.
I am not requesting general support; this is an actual bug report.

Issue Description

We have opened a support ticket for this issue, and we wanted to make sure that this was officially reported here as a bug report. When scheduling multiple users in vacation mode, if the same time is selected for each account when adding OR removing the tasks will fail to execute for one or more of the accounts.

We can replicate this on demand. However, the logs show that it executed the task of adding or removing for each account. It isn't until you login to Entra and look at the policy that you find it actually didn't.

We have staggered the accounts in 15 minutes intervals, and this also fails. The only solution that has shown to work is 30 minute intervals between the additions and the removals. However, in our testing if any of the executions happen at the same time whether add and remove or a combination of them there is a high chance of failure.

We feel like this can create an unnecessary attack vector if a removal is not actually performed. For now we will use the 30 minute intervals, but this also takes away from the efficiency of the feature. It has been observed that this issue may be only with multiple accounts at the same time in the same tenant. One test using two tenants but adding the accounts at the same time seemed to work.

Environment Type

Front End Version

8.1.1

Back End Version

8.1.1

Relevant Logs / Stack Trace

Originally created by @theknoxtech on GitHub (Jul 2, 2025). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/4392 Originally assigned to: @JohnDuprey on GitHub. ### Required confirmations before submitting - [x] **I can reproduce this issue on the latest released versions** of both CIPP and CIPP-API. - [x] **I have searched existing issues** (both open and closed) to avoid duplicates. - [x] I am **not** requesting general support; this is an actual bug report. ### Issue Description We have opened a support ticket for this issue, and we wanted to make sure that this was officially reported here as a bug report. When scheduling multiple users in vacation mode, if the same time is selected for each account when adding OR removing the tasks will fail to execute for one or more of the accounts. We can replicate this on demand. However, the logs show that it executed the task of adding or removing for each account. It isn't until you login to Entra and look at the policy that you find it actually didn't. We have staggered the accounts in 15 minutes intervals, and this also fails. The only solution that has shown to work is 30 minute intervals between the additions and the removals. However, in our testing if any of the executions happen at the same time whether add and remove or a combination of them there is a high chance of failure. We feel like this can create an unnecessary attack vector if a removal is not actually performed. For now we will use the 30 minute intervals, but this also takes away from the efficiency of the feature. It has been observed that this issue may be only with multiple accounts at the same time in the same tenant. One test using two tenants but adding the accounts at the same time seemed to work. ### Environment Type Sponsored (paying) user ### Front End Version 8.1.1 ### Back End Version 8.1.1 ### Relevant Logs / Stack Trace ```plaintext ```

kerem

2026-03-02 13:48:48 +03:00

closed this issue
added the
bug

needs more info
labels

kerem commented

2026-03-02 13:48:49 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jul 2, 2025):

Thank you for reporting a potential bug. If you would like to work on this bug, please comment:

I would like to work on this please!

Thank you for helping us maintain the project!

@github-actions[bot] commented on GitHub (Jul 2, 2025): Thank you for reporting a potential bug. If you would like to work on this bug, please comment: > I would like to work on this please! Thank you for helping us maintain the project!

kerem commented

2026-03-02 13:48:49 +03:00

Author

Owner

@rvdwegen commented on GitHub (Aug 1, 2025):

Hi @theknoxtech,

Could you confirm if this is still happening after the release from a few weeks ago? That included a fix to stagger executions.

@rvdwegen commented on GitHub (Aug 1, 2025): Hi @theknoxtech, Could you confirm if this is still happening after the release from a few weeks ago? That included a fix to stagger executions.

kerem commented

2026-03-02 13:48:49 +03:00

Author

Owner

@theknoxtech commented on GitHub (Aug 5, 2025):

@rvdwegen
Ok, so I did some testing this morning. It appears that it is still exhibiting the same behavior. I parsed the json from Entra logs and modified values and values before modification. I found something pretty strange.

I added three users all for 9:30am EST this morning. 1 test account was added by itself. The other two were added in the same job.

This is before the commands were executed. There is a group excluded and all users and nothing else.

I then added one user to the exclude in Vacation Mode

In this next screenshot, the this is old value before the next two users I added for the same time frame

And in the logs right after this, the two users are here that were added in one scheduling. But the user I scheduled by itself is not here.

@theknoxtech commented on GitHub (Aug 5, 2025): @rvdwegen Ok, so I did some testing this morning. It appears that it is still exhibiting the same behavior. I parsed the json from Entra logs and modified values and values before modification. I found something pretty strange. I added three users all for 9:30am EST this morning. 1 test account was added by itself. The other two were added in the same job. This is before the commands were executed. There is a group excluded and all users and nothing else. <img width="610" height="547" alt="Image" src="https://github.com/user-attachments/assets/ed913211-dfbd-40d3-a2b4-a6d7fa767c04" /> I then added one user to the exclude in Vacation Mode <img width="678" height="527" alt="Image" src="https://github.com/user-attachments/assets/a65e2738-02f7-4315-a40b-e3524ddceaf2" /> In this next screenshot, the this is old value before the next two users I added for the same time frame <img width="695" height="214" alt="Image" src="https://github.com/user-attachments/assets/c223f36a-c567-47ff-ad08-ffc0f6b0e74b" /> And in the logs right after this, the two users are here that were added in one scheduling. But the user I scheduled by itself is not here. <img width="697" height="227" alt="Image" src="https://github.com/user-attachments/assets/f63bef97-5386-4410-b19a-44ee5c10b18a" />

kerem commented

2026-03-02 13:48:49 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Aug 20, 2025):

Resolved in dev

@KelvinTegelaar commented on GitHub (Aug 20, 2025): Resolved in dev

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#1996

No description provided.

Rows
Columns