Skip to content

EntraChecks v1.5.0 — SOC 2 Readiness + Unified Report Enhancements

Choose a tag to compare

View all tags
@NamelessSaint8 NamelessSaint8 released this 04 May 21:05
· 117 commits to main since this release
v1.5.0
24791ff

First formal release. EntraChecks v1.5.0 ships a complete SOC 2 readiness toolkit, a substantially upgraded unified compliance report, and a series of UX/quality fixes.

Highlights

SOC 2 Internal Readiness Assessment (new)

Full TSC-structured SOC 2 readiness pass complementing the existing security checks.

  • AICPA TSC 2017 (revised 2022) catalog covering CC, A, C, PI, P families
  • Type 1 + Type 2 support — Type 2 includes period coverage, snapshot consistency state machine, and cross-snapshot evidence aggregation
  • Phase 2 Azure-readiness checks (6 new): backup/recovery vaults, service health, diagnostic settings, break-glass accounts, encryption posture, EDR connector state — all with licensing graceful-degradation
  • Evidence bundle with SHA-256 chain-of-custody, manifest, and Test-SOC2EvidenceBundle verification cmdlet
  • PII redaction via salted SHA-256 hashing with optional ACL-locked identity-resolution map for re-resolving hashes from PowerShell or via the in-report lookup widget
  • White-label branding (organization name, logo, primary color) for partner-firm distribution
  • Auto-run mode — set SOC2.Enabled = true in config and the SOC 2 pass produces alongside Quick Assessment automatically
  • 75 Pester tests across the SOC 2 module suite, fixture-driven (no live tenant required)
  • See docs/SOC2-Guide.md for the full workflow

Unified Compliance Report Enhancements

The HTML/Excel/CSV report is dramatically more useful.

  • Executive digest with one-line posture verdict (`STRONG` / `MINOR DEFICIENCIES` / `GAPS IDENTIFIED` / `INSUFFICIENT DATA`)
  • Wired previously-discarded data — Microsoft Secure Score (with top-10 improvement actions), Azure Policy compliance state, and Purview Compliance Manager scores now render as dedicated sections in the unified HTML and as new Excel sheets / CSV files
  • Integrity badge — SHA-256 of canonical findings JSON written to a sidecar; new `Test-EntraChecksReportIntegrity` cmdlet verifies the round-trip for chain-of-custody when handing reports to auditors
  • Per-finding deep links with stable anchor IDs and clipboard-copy affordance
  • Print stylesheet — `@media print` rules force black-on-white, hide nav/filters, and protect against page-break splits inside finding cards
  • "Since last assessment" delta card — pass `-PreviousAssessment` to render Resolved/New/Persistent counts inline in the executive section
  • Low-confidence banner — flag fixture-verified-only checks with a yellow callout and per-finding tag
  • CSV fallback now mirrors all 12 sheets (was previously a stub) — users without the optional ImportExcel module get a complete numbered CSV bundle
  • Graceful degradation — sections render "Not collected" placeholders when the underlying module didn't run, instead of silently disappearing

UX & Quality

  • Reduced authentication prompts — Graph scope set synchronized between the menu-driven and stand-alone code paths; cached-MgContext guard tightened to compare against the full union, eliminating mid-run silent re-prompts
  • Identity-lookup file:// picker fallback — the SOC 2 report's identity-lookup widget now falls back to a `` picker when Chromium blocks `fetch()` of local files; the resolution map stays in tab memory only, preserving the redaction model
  • Configuration namespace migration — `SOC2.Phase2.` config keys migrated to `SOC2.AzureReadiness.` with backwards-compat shim
  • Robustness fixes — `Get-QuickWinsSection`/`Get-PrioritySection` now tolerate null/empty inputs (PowerShell 5.1's `Where-Object` returns `$null` not `@()`); `Import-Configuration` PS 5.1 compatibility; PSCustomObject↔Hashtable coercion crash in SOC 2 workbook writer
  • CI/CD — PR comment workflow fixed; PSScriptAnalyzer clean across the repo

Upgrading

No action required. All changes are additive; existing CLI invocations continue to work unchanged. To opt into SOC 2 auto-run, set `SOC2.Enabled = true` in `config\entrachecks.config.json`. To verify report integrity on existing reports, regenerate them under v1.5.0 — pre-v1.5.0 reports do not have the integrity sidecar.

Documentation

Assets 2
Loading