EntraChecks v1.9.0

🖥️ Access Review moves into the desktop app — and browser sign-in works again

EntraChecks 1.9.0 brings the User Access Review workflow shipped in 1.8.0 out of the console menu and into the desktop app, adds an opt-in remediation script generator that turns review decisions into a script you run, and fixes interactive sign-in — which an SDK change had broken.

---

🔑 Interactive sign-in restored (upgrade if you use Browser sign-in)

Browser sign-in stopped working in the desktop app and failed with a misleading Authentication did not produce a Microsoft Graph context (no account). The cause was outside this repo: Azure.Identity 1.18 (pulled in by Microsoft.Graph 2.37+) made the WAM broker mandatory for InteractiveBrowserCredential, and the broker refuses to start without a parent window handle. The app launched the engine with CREATE_NO_WINDOW, so there was no window to hand it.

• The app now allocates a real console once, hides it, and lets child processes inherit it — including under a ConPTY host such as Windows Terminal, where AllocConsole is refused because the process is already attached to one. It never hides a console it did not create.
• The engine falls back to device code when the broker genuinely can't be used, and now reports the underlying error instead of discarding it and guessing.

If you were stuck on "it won't even prompt me to sign in", this is the fix.

📋 Access Review in the app

A campaign is audit evidence, so it lives outside the temporary run folder and the app remembers where you put it.

• Campaign folder (persisted between launches), campaign list, and Open / Close / Regenerate report buttons.
• Step-by-step directions in the panel — the decision vocabulary (Certify / Revoke / Modify / Investigate), the three sign-off rows, and the warning that closing before you make the access changes flags every revoke as NOT_REMEDIATED. The reviewer is usually not the person who ran the tool, and a pre-seeded CSV doesn't state its own vocabulary.
• In concert with an assessment — tick Also open an access-review campaign to add an Access Review phase to a normal run, reusing the privileged roster that run already builds.
• Headless parity for automation: -Mode AccessReview -AccessReviewAction Open|Close|Report|Remediate.

🛠️ Remediation script generator (opt-in, off by default)

A Revoke decision records intent — EntraChecks is read-only and has never revoked anything. 1.9.0 will now write the script that would, so you don't have to translate a worksheet into PIM clicks by hand.

EntraChecks generates the script. It never runs it. That is the whole design:

• Reads only campaign files — no Graph calls, no new scopes, no consent change. A Global Reader can generate a script that a Global Administrator later runs.
• Emits a remediation-plan.md next to the script: provenance (campaign, tenant, bundle SHA-256, reviewer, sign-off date), counts, a per-principal table, and an explicit "what a human still has to do" section — a Modify decision doesn't say what to modify, so it becomes a commented # TODO carrying the reviewer's notes.
• The generated script is dry-run unless -Execute, refuses to run on a campaign older than 30 days without -Force, never removes the last Global Administrator, never touches a break-glass identity (it prints the patterns at start-up), refuses -Execute outright if it can't determine which identity is running it, and appends every removal to remediation-log-<utc>.json before making it.
• Ships disabled. Set AccessReview.EnableRemediation to true in config/entrachecks.config.json to enable; otherwise the action fails closed with a message telling you which key to set.

🔄 The in-app updater actually works now

Every release before this one shipped an updater that checked a version.json no release had ever published — it 404'd every time, silently. The Desktop workflow now generates and publishes that manifest as a release asset. 1.9.0 is the first release the updater can see, so a 1.8.0 install should finally show the update banner instead of nothing.

🩹 Fixes

• open_report refuses to shell-open executable artifacts (.ps1, .psm1, .bat, .cmd, .com, .exe, .vbs, .js) and reveals the containing folder instead — with a script generator in the product, "open" must never quietly mean "run".
• Disabled buttons now render as disabled. An explicit colour was defeating the engine default, so gated actions looked clickable.
• Scoop manifest, WinGet manifest, README, in-app updater URL and module reference URL updated to the current repository owner (the old handle only worked via GitHub's rename redirect).
• Windows Tauri CLI binary pinned in the lockfile so CI resolves it reproducibly.
• Restored a generator-refusal test that the remediation opt-in commit had displaced into the wrong Describe block.

---

Verification: 1105 tests passing / 11 skipped on the Windows full sweep, 1026 on the cross-platform lane; 57 Rust tests; PSScriptAnalyzer and clippy clean.

Install: download EntraChecks_1.9.0_x64-setup.exe from the Assets below, or scoop install entrachecks / winget install EntraChecks. The installer is unsigned — EntraChecks is a FOSS project and code-signing certificates are not free — so SmartScreen will warn on first run. The PowerShell CLI/TUI needs no installation: clone and run Start-EntraChecks.ps1.

Full Changelog: v1.8.0...v1.9.0

EntraChecks v1.8.0 — User Access Review Campaigns

🔐 User Access Review campaigns — audit evidence on demand

EntraChecks 1.8.0 adds a complete User Access Review (UAR) evidence workflow — the "show me your periodic access reviews" package SOC 2 and PCI DSS assessors ask for, generated and verified by the tool. Maps to SOC 2 TSC CC6.1–CC6.3 and PCI DSS v4.0 7.2.4 / 7.2.5.1.

---

📋 Access Review campaigns (new — menu option [9])

A campaign is one review period (quarterly by default). The workflow is open → human review → close:

• Open generates the system-generated evidence: a roster of every user with their directory-role assignments, a dedicated administrators roster (tier classification, permanent vs PIM-eligible, why privileged — sourced from the Privileged Identity Roster), and a pre-seeded review worksheet the reviewer completes in Excel. Campaign metadata proves system generation: tenant ID, UTC timestamp, tool version, the authenticated Graph principal, and a SHA-256 manifest over every artifact.
• Worksheet scope is assessor-proof by design: enabled members, guests (config-toggleable), and every privileged principal — including disabled admin accounts and service principals (PCI 7.2.5.1). A campaign refuses to open if administrators can't be tagged.
• Close ingests the completed worksheet with strict validation (every principal needs a Certify / Revoke / Modify / Investigate decision; sign-off required; added/removed/tampered rows rejected), re-pulls the tenant, and runs the verification pass:
  • Revoke/Modify decisions with no observed removal/disable/deletion → flagged NOT_REMEDIATED
  • changes nobody decided on → flagged UNEXPLAINED_CHANGE
• AccessReview-Report.html — a standalone, self-contained seven-section report: system-generation cover, review summary, administrators reviewed, all users reviewed, changes made as a result of the review, updated user list (or an explicit "no changes required" statement), and reviewer sign-off with the completed worksheet's SHA-256. Open campaigns render with a DRAFT watermark.
• The completed worksheet (decisions + sign-off) is hashed into the same manifest chain as the system-generated data — one tamper-evident bundle per review period.
• New AccessReview block in config/entrachecks.config.json; full runbook in docs/AccessReview-Guide.md.

🧾 SOC 2 report integration

• When a closed campaign exists, the SOC 2 Evidence Matrix automatically cites its report and bundle hash as CC6.1 / CC6.2 / CC6.3 evidence (reference-if-present — no campaign, no change).

🩹 PowerShell 5.1 compatibility fixes

• UTF-8 BOMs added to the new modules and EntraChecks-PrivilegedIdentityEntra.psm1, which had a latent Windows PowerShell 5.1 parse failure since 1.6.0: BOM-less files decode as ANSI under 5.1, and an em-dash inside a double-quoted string turns into a curly quote that terminates the string.

🧪 Test & CI reliability

• The Invoke-MgGraphRequest CI stub now declares a real parameter block, so URI-discriminating Pester mocks work on machines without Microsoft.Graph — this was the actual root cause behind the SOC2-Phase2 "KnownAssertionDrift" skips, and those four break-glass tests are back in the cross-platform CI lane.
• The Privileged Identity AD roster suite runs again on machines without RSAT (global AD cmdlet shims with real parameter names).
• Cockpit renderer tests updated to the four-state Deep Dive Hub / hero header markup shipped in 1.7.0.
• PSScriptAnalyzer: repo is clean again (device-code SecureString construction reworked, dead assignment removed, empty catch now logs).

---

Install: download EntraChecks_1.8.0_x64-setup.exe from the Assets below, or scoop install entrachecks / winget install EntraChecks once the package-manager PRs land. The PowerShell CLI/TUI needs no installation — clone and run Start-EntraChecks.ps1.

EntraChecks v1.7.0

🎉 First release with a native Windows desktop app

EntraChecks 1.7.0 is the first version that ships a real Windows desktop GUI alongside the existing PowerShell CLI / TUI. The CLI is unchanged from 1.6.0 — pick whichever surface fits your workflow; both drive the same assessment engine and produce the same reports.

---

🖥️ Desktop app (new)

• One-click NSIS installer (~3 MB) — download EntraChecks_1.7.0_x64-setup.exe from the Assets below.
• GUI module picker — checkboxes for the seven core modules (Core / Identity Protection / Devices / Secure Score / Defender / Azure Policy / Purview), plus presets ("Select all" / "Core only").
• Deep-dive picker — separate checkbox group for the on-demand deep-dive reports (Secure Score, Defender Compliance, Azure Policy, Purview, Delta, Privileged Identity).
• Auth dropdown — Device code (default), Browser sign-in, or "Use existing session".
• Built-in readiness check — detects missing PowerShell modules (Microsoft.Graph, Az.*, ImportExcel) and offers to install them with one click.
• Live streaming output — every engine line shows up in the log pane in real time; phase status (running / ok / failed) tracked separately.
• Result card — finding counts plus direct "Open cockpit-html" / "Open json" buttons.
• Cancel button — drops a sentinel that the engine picks up at the next phase boundary.

---

🛬 Analyst Cockpit polish

The cockpit HTML report grew several new sections and a major UX pass:

• New "Compliance Posture (Defender for Cloud)" section — heatmap-style rows for every assessed standard (Azure CIS, NIST 800-53, PCI-DSS, ISO-27001, SOC-2, etc.), sorted worst-first, with accordions that expand to the top 25 failing controls per standard.
• Executive Digest redesign — replaces the prior one-paragraph summary with: a 5-stat row (Total / Critical / High / To Review / Quick Wins), feature-card-style Top Findings (risk pill + description + object + remediation), and Compliance gap accordions that drill into the specific failing controls under each framework rather than just showing a count.
• Hero header — tenant name dominates; product wordmark, tenant ID, and "Generated at" are secondary; posture badge + finding count anchored on the right.
• Full Findings cleanup — primary 3 filters (search / status / risk) stay visible; the eight secondary filters (disposition, source, owner, framework, control, exception state, review state, due date) collapse into an "Advanced filters" <details> group.
• Deep Dive Hub four honest states — every domain now reports exactly one of: Generated (with working link to the deep-dive HTML), Skipped — no data, Skipped — not collected, or Skipped — not requested. No more vague "pending" cards.

---

🐛 Engine fixes (also benefits the CLI / TUI)

• report.writeFailed (Path argument was null) — root caused to Export-*Report calls leaking their hashtable return into Export-AssessmentResult's pipeline; piped to Out-Null.
• ConvertTo-EntraFindingV2 empty-CheckName warnings — legacy IdentityProtection / Devices findings without a Check field now produce stable ECF FindingIds (AllowEmptyString + fallback to Check → Object).
• Deep-dive reports that wouldn't generate — Import-Module … -Force was wiping each module's $script:XData right before Export-*Report tried to read it. Defender / Azure Policy / Purview now receive their data explicitly via parameter.
• "Open deep dive" link 404 — deep-dive files live in a DeepDives/ subfolder but the cockpit link was just the filename, so the browser resolved it as a sibling of the cockpit. Now uses Path.GetRelativePath with a DeepDives/<file> fallback.
• Long application names rendering one character per line — word-break: break-all replaced with overflow-wrap: anywhere plus explicit min-width on the Object / Description grid tracks.
• Device-code prompt invisible — Console.Out.WriteLine was buffering the device code event during the 30–90 s polling loop; added Console.Out.Flush() after every emitted event.
• 0 findings on real tenants — Tauri's resource_dir() returns \\?\C:\... (Windows long-path prefix) which PowerShell's Test-Path against the FileSystem provider returns False for. The Rust shell now strips the prefix; the engine also strips defensively.
• Initialize-LoggingSubsystem not recognized — Import-Module … -ErrorAction SilentlyContinue was swallowing real load errors. Replaced with explicit try/catch surface in Start-EntraChecks.ps1.

---

📦 Installation

1. Download EntraChecks_1.7.0_x64-setup.exe from the Assets section below.
2. On first install Windows SmartScreen will show "Windows protected your PC" — this is expected. The installer is unsigned by design (purchased code-signing certificates run $200–$500/year and this is a free tool). Click More info → Run anyway.
3. Launch EntraChecks from the Start menu. If any required PowerShell modules are missing the app will offer to install them.
4. Pick a tenant, sign in, tick modules / deep-dives, click Run assessment.

PowerShell-only users can keep running .\Start-EntraChecks.ps1 exactly as in 1.6.0. Engine fixes in this release apply to both surfaces.

---

🔐 What this release is not

• Not signed — see the Code signing section in the README for the reasoning and how to flip CI to signed builds if you ever wire up a cert.
• Not auto-updating — there's an update-check stub but no in-app updater yet. Re-run the installer to upgrade.
• macOS / Linux not shipped — the engine is PowerShell-on-Windows; the Tauri shell compiles on macOS / Linux (it does in CI) but the engine it spawns requires Windows-side modules. Windows-only release is intentional.

---

🙏 Thanks

If EntraChecks saves you time, a Ko-fi goes straight back into keeping it free.

EntraChecks v1.6.0 — On-Premises AD + Hybrid Analysis

Adds on-premises Active Directory as a first-class module, plus the Hybrid Analysis mode that runs cloud + on-prem together and correlates identity-bearing findings across the two planes.

Highlights

Active Directory module (new)

33 read-only AD security checks integrated into the EntraChecks orchestrator. Schema-aligned findings flow into the unified HTML / Excel / CSV reports alongside cloud findings. Graceful degradation when not domain-joined / without RSAT / on non-Windows.

Categories covered:

• Privileged Access (15 checks) — Domain/Enterprise/Schema Admins, Protected Users, AdminSDHolder drift, dangerous SIDs, OU+GPO delegation, nested group paths, LAPS deployment, DirSync account privilege audit
• Authentication (7 checks) — password policy, KRBTGT age, Kerberos pre-auth, duplicate SPNs, user SPNs, GPP cpasswords in SYSVOL, Kerberoastable accounts with password-age + RC4 correlation
• Delegation (2 checks) — unconstrained delegation, constrained overview
• Account Lifecycle (4 checks) — stale accounts, password never expires, managed service accounts, passwords in Description
• Infrastructure (5 checks) — forest/domain info, DCs, domain trusts, GPO inventory, DC security settings (LDAP signing, channel binding, SMB signing)

Critical-severity checks: unconstrained delegation, KRBTGT age, AdminSDHolder drift, dangerous SIDs, GPP cpasswords, Kerberoastable (privileged), DirSync account in Domain Admins.

Hybrid Analysis mode (new)

New `[Y] Hybrid Analysis` main-menu item + `-Mode Hybrid` CLI. Runs cloud + hybrid + on-prem in a single invocation and produces a cross-plane principal correlation report highlighting users flagged in BOTH identity planes.

• Exact matches — UPN-level (Confidence='Exact')
• Inferred matches — sAMAccountName fallback when UPN-level can't confirm (Confidence='Inferred')
• New section in unified HTML, new Excel sheet (`Hybrid Correlation`), new CSV file (`13-HybridCorrelation.csv`)
• Invoke-able as `.\Start-EntraChecks.ps1 -Mode Hybrid -TenantName "Contoso"`

SOC 2 CC6 integration

AD findings carry `SOC2-CC6.1` / `SOC2-CC6.2` in `ComplianceFrameworks` automatically. When SOC 2 readiness is enabled, they flow into the CC6 control-evidence tables in the SOC 2 report without additional configuration.

Upgrading

No action required. All changes are additive:

• Quick Assessment stays cloud-only (no behavior change for existing workflows).
• Opt into AD via `[8] Active Directory` menu item, `[Y] Hybrid Analysis`, or CLI `-Modules ActiveDirectory` / `-Mode Hybrid`.
• Optional `ActiveDirectory` config block added to `config/entrachecks.config.json` — defaults off.
• `ad/ActiveDirectoryv3.ps1` (the standalone pre-v1.6.0 script) has been removed; its content lives in `Modules/EntraChecks-ActiveDirectory.psm1` now.

Under the hood

• Modules added: `EntraChecks-ActiveDirectory.psm1` (~1700 lines), `EntraChecks-HybridCorrelation.psm1`
• Docs added: `docs/ActiveDirectory-Guide.md`, `docs/Hybrid-Analysis-Guide.md`
• Tests added: `Tests/EntraChecks-ActiveDirectory.Tests.ps1` (24 tests for PR 1, +9 for PR 2), `Tests/EntraChecks-HybridCorrelation.Tests.ps1` (11 tests)
• Coverage: 44 Pester tests shipped for the AD+Hybrid surface (fixture-driven, no live domain required on CI)
• Quality: PSScriptAnalyzer 0 warnings across all changed files

Deferred

Planned for future releases but not in v1.6.0:

• AD CS template vulnerabilities (ESC1-8) — whole-PR effort given the depth of PKI analysis
• BloodHound-style ACL abuse path enumeration
• SMBv1 / NetBIOS / LLMNR host enumeration
• Reversible-encryption audit

Documentation

• README.md
• docs/ActiveDirectory-Guide.md — prerequisites, 33-check reference, framework mappings, troubleshooting
• docs/Hybrid-Analysis-Guide.md — correlation model, Confidence flags, report layout, common scenarios

EntraChecks v1.5.0 — SOC 2 Readiness + Unified Report Enhancements

First formal release. EntraChecks v1.5.0 ships a complete SOC 2 readiness toolkit, a substantially upgraded unified compliance report, and a series of UX/quality fixes.

Highlights

SOC 2 Internal Readiness Assessment (new)

Full TSC-structured SOC 2 readiness pass complementing the existing security checks.

• AICPA TSC 2017 (revised 2022) catalog covering CC, A, C, PI, P families
• Type 1 + Type 2 support — Type 2 includes period coverage, snapshot consistency state machine, and cross-snapshot evidence aggregation
• Phase 2 Azure-readiness checks (6 new): backup/recovery vaults, service health, diagnostic settings, break-glass accounts, encryption posture, EDR connector state — all with licensing graceful-degradation
• Evidence bundle with SHA-256 chain-of-custody, manifest, and Test-SOC2EvidenceBundle verification cmdlet
• PII redaction via salted SHA-256 hashing with optional ACL-locked identity-resolution map for re-resolving hashes from PowerShell or via the in-report lookup widget
• White-label branding (organization name, logo, primary color) for partner-firm distribution
• Auto-run mode — set SOC2.Enabled = true in config and the SOC 2 pass produces alongside Quick Assessment automatically
• 75 Pester tests across the SOC 2 module suite, fixture-driven (no live tenant required)
• See docs/SOC2-Guide.md for the full workflow

Unified Compliance Report Enhancements

The HTML/Excel/CSV report is dramatically more useful.

• Executive digest with one-line posture verdict (`STRONG` / `MINOR DEFICIENCIES` / `GAPS IDENTIFIED` / `INSUFFICIENT DATA`)
• Wired previously-discarded data — Microsoft Secure Score (with top-10 improvement actions), Azure Policy compliance state, and Purview Compliance Manager scores now render as dedicated sections in the unified HTML and as new Excel sheets / CSV files
• Integrity badge — SHA-256 of canonical findings JSON written to a sidecar; new `Test-EntraChecksReportIntegrity` cmdlet verifies the round-trip for chain-of-custody when handing reports to auditors
• Per-finding deep links with stable anchor IDs and clipboard-copy affordance
• Print stylesheet — `@media print` rules force black-on-white, hide nav/filters, and protect against page-break splits inside finding cards
• "Since last assessment" delta card — pass `-PreviousAssessment` to render Resolved/New/Persistent counts inline in the executive section
• Low-confidence banner — flag fixture-verified-only checks with a yellow callout and per-finding tag
• CSV fallback now mirrors all 12 sheets (was previously a stub) — users without the optional ImportExcel module get a complete numbered CSV bundle
• Graceful degradation — sections render "Not collected" placeholders when the underlying module didn't run, instead of silently disappearing

UX & Quality

• Reduced authentication prompts — Graph scope set synchronized between the menu-driven and stand-alone code paths; cached-MgContext guard tightened to compare against the full union, eliminating mid-run silent re-prompts
• Identity-lookup file:// picker fallback — the SOC 2 report's identity-lookup widget now falls back to a `` picker when Chromium blocks `fetch()` of local files; the resolution map stays in tab memory only, preserving the redaction model
• Configuration namespace migration — `SOC2.Phase2.` config keys migrated to `SOC2.AzureReadiness.` with backwards-compat shim
• Robustness fixes — `Get-QuickWinsSection`/`Get-PrioritySection` now tolerate null/empty inputs (PowerShell 5.1's `Where-Object` returns `$null` not `@()`); `Import-Configuration` PS 5.1 compatibility; PSCustomObject↔Hashtable coercion crash in SOC 2 workbook writer
• CI/CD — PR comment workflow fixed; PSScriptAnalyzer clean across the repo

Upgrading

No action required. All changes are additive; existing CLI invocations continue to work unchanged. To opt into SOC 2 auto-run, set `SOC2.Enabled = true` in `config\entrachecks.config.json`. To verify report integrity on existing reports, regenerate them under v1.5.0 — pre-v1.5.0 reports do not have the integrity sidecar.

Documentation

• README.md — quick start
• docs/SOC2-Guide.md — SOC 2 workflow
• docs/USER-GUIDE.md — complete reference