EntraChecks v1.8.0 — User Access Review Campaigns

🔐 User Access Review campaigns — audit evidence on demand

EntraChecks 1.8.0 adds a complete User Access Review (UAR) evidence workflow — the "show me your periodic access reviews" package SOC 2 and PCI DSS assessors ask for, generated and verified by the tool. Maps to SOC 2 TSC CC6.1–CC6.3 and PCI DSS v4.0 7.2.4 / 7.2.5.1.

---

📋 Access Review campaigns (new — menu option [9])

A campaign is one review period (quarterly by default). The workflow is open → human review → close:

• Open generates the system-generated evidence: a roster of every user with their directory-role assignments, a dedicated administrators roster (tier classification, permanent vs PIM-eligible, why privileged — sourced from the Privileged Identity Roster), and a pre-seeded review worksheet the reviewer completes in Excel. Campaign metadata proves system generation: tenant ID, UTC timestamp, tool version, the authenticated Graph principal, and a SHA-256 manifest over every artifact.
• Worksheet scope is assessor-proof by design: enabled members, guests (config-toggleable), and every privileged principal — including disabled admin accounts and service principals (PCI 7.2.5.1). A campaign refuses to open if administrators can't be tagged.
• Close ingests the completed worksheet with strict validation (every principal needs a Certify / Revoke / Modify / Investigate decision; sign-off required; added/removed/tampered rows rejected), re-pulls the tenant, and runs the verification pass:
  • Revoke/Modify decisions with no observed removal/disable/deletion → flagged NOT_REMEDIATED
  • changes nobody decided on → flagged UNEXPLAINED_CHANGE
• AccessReview-Report.html — a standalone, self-contained seven-section report: system-generation cover, review summary, administrators reviewed, all users reviewed, changes made as a result of the review, updated user list (or an explicit "no changes required" statement), and reviewer sign-off with the completed worksheet's SHA-256. Open campaigns render with a DRAFT watermark.
• The completed worksheet (decisions + sign-off) is hashed into the same manifest chain as the system-generated data — one tamper-evident bundle per review period.
• New AccessReview block in config/entrachecks.config.json; full runbook in docs/AccessReview-Guide.md.

🧾 SOC 2 report integration

• When a closed campaign exists, the SOC 2 Evidence Matrix automatically cites its report and bundle hash as CC6.1 / CC6.2 / CC6.3 evidence (reference-if-present — no campaign, no change).

🩹 PowerShell 5.1 compatibility fixes

• UTF-8 BOMs added to the new modules and EntraChecks-PrivilegedIdentityEntra.psm1, which had a latent Windows PowerShell 5.1 parse failure since 1.6.0: BOM-less files decode as ANSI under 5.1, and an em-dash inside a double-quoted string turns into a curly quote that terminates the string.

🧪 Test & CI reliability

• The Invoke-MgGraphRequest CI stub now declares a real parameter block, so URI-discriminating Pester mocks work on machines without Microsoft.Graph — this was the actual root cause behind the SOC2-Phase2 "KnownAssertionDrift" skips, and those four break-glass tests are back in the cross-platform CI lane.
• The Privileged Identity AD roster suite runs again on machines without RSAT (global AD cmdlet shims with real parameter names).
• Cockpit renderer tests updated to the four-state Deep Dive Hub / hero header markup shipped in 1.7.0.
• PSScriptAnalyzer: repo is clean again (device-code SecureString construction reworked, dead assignment removed, empty catch now logs).

---

Install: download EntraChecks_1.8.0_x64-setup.exe from the Assets below, or scoop install entrachecks / winget install EntraChecks once the package-manager PRs land. The PowerShell CLI/TUI needs no installation — clone and run Start-EntraChecks.ps1.