fix(ui): handle level 1 requirements for M365 CIS (#11921)

ui/changelog.d/cis-profile-level-filter-m365.fixed.md

@@ -0,0 +1 @@
+CIS Level 1 and Level 2 compliance filters now match profiles prefixed with a license tier (e.g. "E3 Level 1"), so M365 CIS requirements are no longer hidden

ui/lib/compliance/cis.tsx

@@ -38,8 +38,11 @@ export const mapComplianceData = (
     const attrs = metadataArray?.[0];
     if (!attrs) continue;
 
-    // Apply profile filter
-    if (filter === "Level 1" && attrs.Profile !== "Level 1") {
+    // Apply profile filter.
+    // Most CIS benchmarks use "Level 1"/"Level 2" as the Profile, but some
+    // (e.g. M365) prefix it with the license tier: "E3 Level 1", "E5 Level 2".
+    // Match by suffix so the Level 1 filter works across all CIS variants.
+    if (filter === "Level 1" && !attrs.Profile?.endsWith("Level 1")) {
       continue; // Skip Level 2 requirements when Level 1 is selected
     }
 

ui/types/compliance.ts

@@ -127,7 +127,7 @@ export interface ISO27001AttributesMetadata {
 export interface CISAttributesMetadata {
   Section: string;
   SubSection: string | null;
-  Profile: string; // "Level 1" or "Level 2"
+  Profile: string; // "Level 1"/"Level 2" (M365 prefixes the tier: "E3 Level 1", "E5 Level 2")
   AssessmentStatus: string; // "Manual" or "Automated"
   Description: string;
   RationaleStatement: string;