EntraChecks v1.9.0

🖥️ Access Review moves into the desktop app — and browser sign-in works again

EntraChecks 1.9.0 brings the User Access Review workflow shipped in 1.8.0 out of the console menu and into the desktop app, adds an opt-in remediation script generator that turns review decisions into a script you run, and fixes interactive sign-in — which an SDK change had broken.

---

🔑 Interactive sign-in restored (upgrade if you use Browser sign-in)

Browser sign-in stopped working in the desktop app and failed with a misleading Authentication did not produce a Microsoft Graph context (no account). The cause was outside this repo: Azure.Identity 1.18 (pulled in by Microsoft.Graph 2.37+) made the WAM broker mandatory for InteractiveBrowserCredential, and the broker refuses to start without a parent window handle. The app launched the engine with CREATE_NO_WINDOW, so there was no window to hand it.

• The app now allocates a real console once, hides it, and lets child processes inherit it — including under a ConPTY host such as Windows Terminal, where AllocConsole is refused because the process is already attached to one. It never hides a console it did not create.
• The engine falls back to device code when the broker genuinely can't be used, and now reports the underlying error instead of discarding it and guessing.

If you were stuck on "it won't even prompt me to sign in", this is the fix.

📋 Access Review in the app

A campaign is audit evidence, so it lives outside the temporary run folder and the app remembers where you put it.

• Campaign folder (persisted between launches), campaign list, and Open / Close / Regenerate report buttons.
• Step-by-step directions in the panel — the decision vocabulary (Certify / Revoke / Modify / Investigate), the three sign-off rows, and the warning that closing before you make the access changes flags every revoke as NOT_REMEDIATED. The reviewer is usually not the person who ran the tool, and a pre-seeded CSV doesn't state its own vocabulary.
• In concert with an assessment — tick Also open an access-review campaign to add an Access Review phase to a normal run, reusing the privileged roster that run already builds.
• Headless parity for automation: -Mode AccessReview -AccessReviewAction Open|Close|Report|Remediate.

🛠️ Remediation script generator (opt-in, off by default)

A Revoke decision records intent — EntraChecks is read-only and has never revoked anything. 1.9.0 will now write the script that would, so you don't have to translate a worksheet into PIM clicks by hand.

EntraChecks generates the script. It never runs it. That is the whole design:

• Reads only campaign files — no Graph calls, no new scopes, no consent change. A Global Reader can generate a script that a Global Administrator later runs.
• Emits a remediation-plan.md next to the script: provenance (campaign, tenant, bundle SHA-256, reviewer, sign-off date), counts, a per-principal table, and an explicit "what a human still has to do" section — a Modify decision doesn't say what to modify, so it becomes a commented # TODO carrying the reviewer's notes.
• The generated script is dry-run unless -Execute, refuses to run on a campaign older than 30 days without -Force, never removes the last Global Administrator, never touches a break-glass identity (it prints the patterns at start-up), refuses -Execute outright if it can't determine which identity is running it, and appends every removal to remediation-log-<utc>.json before making it.
• Ships disabled. Set AccessReview.EnableRemediation to true in config/entrachecks.config.json to enable; otherwise the action fails closed with a message telling you which key to set.

🔄 The in-app updater actually works now

Every release before this one shipped an updater that checked a version.json no release had ever published — it 404'd every time, silently. The Desktop workflow now generates and publishes that manifest as a release asset. 1.9.0 is the first release the updater can see, so a 1.8.0 install should finally show the update banner instead of nothing.

🩹 Fixes

• open_report refuses to shell-open executable artifacts (.ps1, .psm1, .bat, .cmd, .com, .exe, .vbs, .js) and reveals the containing folder instead — with a script generator in the product, "open" must never quietly mean "run".
• Disabled buttons now render as disabled. An explicit colour was defeating the engine default, so gated actions looked clickable.
• Scoop manifest, WinGet manifest, README, in-app updater URL and module reference URL updated to the current repository owner (the old handle only worked via GitHub's rename redirect).
• Windows Tauri CLI binary pinned in the lockfile so CI resolves it reproducibly.
• Restored a generator-refusal test that the remediation opt-in commit had displaced into the wrong Describe block.

---

Verification: 1105 tests passing / 11 skipped on the Windows full sweep, 1026 on the cross-platform lane; 57 Rust tests; PSScriptAnalyzer and clippy clean.

Install: download EntraChecks_1.9.0_x64-setup.exe from the Assets below, or scoop install entrachecks / winget install EntraChecks. The installer is unsigned — EntraChecks is a FOSS project and code-signing certificates are not free — so SmartScreen will warn on first run. The PowerShell CLI/TUI needs no installation: clone and run Start-EntraChecks.ps1.

Full Changelog: v1.8.0...v1.9.0