Skip to content

EntraChecks v1.7.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 22 May 15:04
· 36 commits to main since this release
v1.7.0
7d93665

🎉 First release with a native Windows desktop app

EntraChecks 1.7.0 is the first version that ships a real Windows desktop GUI alongside the existing PowerShell CLI / TUI. The CLI is unchanged from 1.6.0 — pick whichever surface fits your workflow; both drive the same assessment engine and produce the same reports.

🖥️ Desktop app (new)

  • One-click NSIS installer (~3 MB) — download EntraChecks_1.7.0_x64-setup.exe from the Assets below.
  • GUI module picker — checkboxes for the seven core modules (Core / Identity Protection / Devices / Secure Score / Defender / Azure Policy / Purview), plus presets ("Select all" / "Core only").
  • Deep-dive picker — separate checkbox group for the on-demand deep-dive reports (Secure Score, Defender Compliance, Azure Policy, Purview, Delta, Privileged Identity).
  • Auth dropdown — Device code (default), Browser sign-in, or "Use existing session".
  • Built-in readiness check — detects missing PowerShell modules (Microsoft.Graph, Az.*, ImportExcel) and offers to install them with one click.
  • Live streaming output — every engine line shows up in the log pane in real time; phase status (running / ok / failed) tracked separately.
  • Result card — finding counts plus direct "Open cockpit-html" / "Open json" buttons.
  • Cancel button — drops a sentinel that the engine picks up at the next phase boundary.

🛬 Analyst Cockpit polish

The cockpit HTML report grew several new sections and a major UX pass:

  • New "Compliance Posture (Defender for Cloud)" section — heatmap-style rows for every assessed standard (Azure CIS, NIST 800-53, PCI-DSS, ISO-27001, SOC-2, etc.), sorted worst-first, with accordions that expand to the top 25 failing controls per standard.
  • Executive Digest redesign — replaces the prior one-paragraph summary with: a 5-stat row (Total / Critical / High / To Review / Quick Wins), feature-card-style Top Findings (risk pill + description + object + remediation), and Compliance gap accordions that drill into the specific failing controls under each framework rather than just showing a count.
  • Hero header — tenant name dominates; product wordmark, tenant ID, and "Generated at" are secondary; posture badge + finding count anchored on the right.
  • Full Findings cleanup — primary 3 filters (search / status / risk) stay visible; the eight secondary filters (disposition, source, owner, framework, control, exception state, review state, due date) collapse into an "Advanced filters" <details> group.
  • Deep Dive Hub four honest states — every domain now reports exactly one of: Generated (with working link to the deep-dive HTML), Skipped — no data, Skipped — not collected, or Skipped — not requested. No more vague "pending" cards.

🐛 Engine fixes (also benefits the CLI / TUI)

  • report.writeFailed (Path argument was null) — root caused to Export-*Report calls leaking their hashtable return into Export-AssessmentResult's pipeline; piped to Out-Null.
  • ConvertTo-EntraFindingV2 empty-CheckName warnings — legacy IdentityProtection / Devices findings without a Check field now produce stable ECF FindingIds (AllowEmptyString + fallback to Check → Object).
  • Deep-dive reports that wouldn't generate — Import-Module … -Force was wiping each module's $script:XData right before Export-*Report tried to read it. Defender / Azure Policy / Purview now receive their data explicitly via parameter.
  • "Open deep dive" link 404 — deep-dive files live in a DeepDives/ subfolder but the cockpit link was just the filename, so the browser resolved it as a sibling of the cockpit. Now uses Path.GetRelativePath with a DeepDives/<file> fallback.
  • Long application names rendering one character per line — word-break: break-all replaced with overflow-wrap: anywhere plus explicit min-width on the Object / Description grid tracks.
  • Device-code prompt invisible — Console.Out.WriteLine was buffering the device code event during the 30–90 s polling loop; added Console.Out.Flush() after every emitted event.
  • 0 findings on real tenants — Tauri's resource_dir() returns \\?\C:\... (Windows long-path prefix) which PowerShell's Test-Path against the FileSystem provider returns False for. The Rust shell now strips the prefix; the engine also strips defensively.
  • Initialize-LoggingSubsystem not recognized — Import-Module … -ErrorAction SilentlyContinue was swallowing real load errors. Replaced with explicit try/catch surface in Start-EntraChecks.ps1.

📦 Installation

  1. Download EntraChecks_1.7.0_x64-setup.exe from the Assets section below.
  2. On first install Windows SmartScreen will show "Windows protected your PC" — this is expected. The installer is unsigned by design (purchased code-signing certificates run $200–$500/year and this is a free tool). Click More info → Run anyway.
  3. Launch EntraChecks from the Start menu. If any required PowerShell modules are missing the app will offer to install them.
  4. Pick a tenant, sign in, tick modules / deep-dives, click Run assessment.

PowerShell-only users can keep running .\Start-EntraChecks.ps1 exactly as in 1.6.0. Engine fixes in this release apply to both surfaces.

🔐 What this release is not

  • Not signed — see the Code signing section in the README for the reasoning and how to flip CI to signed builds if you ever wire up a cert.
  • Not auto-updating — there's an update-check stub but no in-app updater yet. Re-run the installer to upgrade.
  • macOS / Linux not shipped — the engine is PowerShell-on-Windows; the Tauri shell compiles on macOS / Linux (it does in CI) but the engine it spawns requires Windows-side modules. Windows-only release is intentional.

🙏 Thanks

If EntraChecks saves you time, a Ko-fi goes straight back into keeping it free.

Assets 3
Loading