Azure.Admin.Console 0.14.7

An Azure DevOps inventory - pipelines and the tools they run (with evidence), security posture and delivery metrics - application permissions listed, and rights over chosen Entra groups only; the module organised into child areas (Core, Azure, M365, DevOps) and a faster import. The stable release of everything in 0.14.6-preview1 too.

New

• Azure DevOps inventory. Get-AACADOInventory: one or more organizations (-Organization a, b, or -DiscoverOrganization from your sign-in) - projects, pipelines (YAML, or classic with no YAML file - flagged) and classic releases with their last run and each repository's last push; every task (with its version and what it does, from the task catalogue) and CLI tool (Docker, az, npm, Node.js, MSBuild, Helm, kubectl, Terraform, PowerShell, linters, scanners...) with the version an installer task or the script sets (-View Task); YAML read with its templates - local, template@repo and nested to -TemplateDepth - and classic pipelines' tasks mapped by ID, so lint, build, test, security, deploy and publish categories and "no security scanning" apply to both (-ToolRule adds your own); the security posture of service connections (open to every pipeline, client secret instead of workload identity federation, unused), variable groups (secrets outside Key Vault, secret-looking values not marked secret - names only), environments (production with no approval, no checks, open access) and default branches (required reviewers, build validation); GitHub Advanced Security per repository with active alert counts; delivery metrics over -MetricDays - success rate, duration, queue time, deployment frequency and change failure rate; -YamlPath saves every pipeline's YAML, templates and classic steps for offline review; -IncludeAzure links service connections to their service principals' Azure roles; findings for all of these, secrets in the YAML (never shown), deprecated tasks, unpinned containers and retired images; a PAT, AZURE_DEVOPS_EXT_PAT, or the Azure sign-in (-UseAzureSignIn); -Skip for a faster read; disabled repositories and their pipelines left out unless -IncludeDisabledRepository; progress for each stage with the projects done, the time left and the project being read; each file (pipeline or template) analysed once however many pipelines include it; -View Pipeline|Project|Repository|Task|Tool|ServiceConnection|VariableGroup|Environment|Finding, CSV, HTML and PDF.
• Azure DevOps tools, with evidence. Get-AACADOInventory finds tools from one catalogue (about 150 tools, new GitOps category - Flux, Argo CD, Kustomize - and more linters: MegaLinter, Super-Linter, ansible-lint, SQLFluff, commitlint, cspell, kube-linter, kubeconform...) matched against every file a pipeline runs: its YAML and templates, the script files it calls (and the scripts those call), the package.json scripts and Makefile targets it runs, classic tasks, and container images (their tag is the version). New tabs and views: Evidence (every match with its file, line and masked line text), Coverage (Yes/No per stage per pipeline), Unrecognised (commands no rule knows, most-run first, and templates and files that couldn't be read), and a Tools matrix with versions and how each tool was found. -ToolRulePath loads rules from a .psd1 or JSON file; -MaxScriptFiles limits the files read per pipeline. Command-line tools moved from the Tasks view to the evidence.
• Application permissions, listed. Get-AACApplicationPermission: everything an enterprise application or managed identity holds - application and delegated API permissions, Entra directory roles with their scope (tenant, administrative unit, object; direct, through role-assignable groups, PIM-eligible), Azure roles, owned objects, group memberships, and API permissions requested but not granted - with findings for the privileged ones; by object ID, app ID, app registration ID, name or managed identity resource ID; several at once; -SkipAzure; -View Permission|Finding|Summary, CSV, HTML and PDF.
• Application permission. New-AACApplicationPermission: an enterprise application or managed identity manages specific Entra groups only - an administrative unit with the groups, a custom role with just the group actions (-Access MemberReadWrite|MemberRead|MemberAndOwnerReadWrite, or -AllowedResourceAction) or a built-in role, assigned on the unit instead of the tenant. Plan, confirm (-WhatIf, -Force), apply in order, verify; findings for tenant-wide Graph permissions that override the scope (-RemoveTenantWidePermission), the role at tenant scope, other objects in the unit, dynamic and role-assignable groups; -RestrictedManagement.

Changed

• One module, child areas. The code is organised as a parent with child areas under src\: Core (Connect-AAC, Disconnect-AAC, Show-AACJson, and what every area builds on - HTTP, tokens, the Resource Manager, Resource Graph and Microsoft Graph helpers, progress, console views, CSV, HTML and PDF reports), Azure (68 commands scoped to subscriptions and management groups), M365 (4 commands for the Entra ID / Microsoft 365 tenant: Invoke-AACM365Assessment, Get-AACEntraGroupMembership, Get-AACApplicationPermission, New-AACApplicationPermission) and DevOps (Get-AACADOInventory). Each area has an area.psd1, its commands in Public\ and its helpers in Private\; a test fails if one area calls another area's functions (shared helpers live in Core). Still one module and one install: every command, parameter and output is unchanged. The tests are grouped the same way (Tests\<Area>\), the docs index and the README's command list are grouped by area, and the published package still merges every function into one file for a fast import.
• Faster import. The published module carries every function in one file (Azure.Admin.Console.Functions.ps1, made by build.ps1): it imports in about 2.5 seconds instead of about 5. The repository still loads the files one by one. The display settings of the module's 113 output types are registered in one call instead of 113, and the Spectre.Console hash is checked with .NET's SHA-256.
• Invoke-AACArmParallel (the module's parallel reader) can send an Authorization header of its own instead of the Azure token, follows Azure DevOps' x-ms-continuationtoken paging, and reports an answer that isn't JSON (a sign-in page) as that request's error.
• Internal clean-up, with no change to any command, parameter or output: one KQL string-literal helper instead of 34 copies in six variants (16 didn't escape backslashes, so a value such as a -Query or tag filter ending in \ could break a query); the long-running operation helpers read retry headers through Get-AACRetryDelay (now also a date-form Retry-After and the services' own retry headers); the Defender plan, Defender alert and workspace-name queries, the -TimeRange table and seven copies of a nested-value reader are written once; the unused Invoke-AACPagedRestMethod is gone, and Read-AACNetworkHealthMetric is Read-AACMetric.

Fixed

• Get-AACADOInventory failed at the end of a run ("The property 'Pipelines' cannot be found") when a script ran a command named keys, values or count: a PowerShell hashtable answers .Keys with the entry of that name. The Unrecognised commands are read through .PSBase.Keys now - and so are the tag dictionaries of Export-AACResource, where a tag named Keys, Values or Count had the same effect.
• Get-AACChangeHistory found no alerts for a window that started more than 14 days ago: the 14-day limit of Resource Graph's property-change history was applied to the alerts query too, which then asked for alerts from a start later than its end. Only the property changes are clipped to 14 days now; alerts follow the window.

Install: Install-PSResource -Name Azure.Admin.Console -Version 0.14.7