🗡️ SwissKnife for MS Graph v1.0.0

SwissKnife for MS Graph 1.0.0 — "Work from tasks"

The release where the app stops being a Graph browser and starts being a tool
for the tickets you actually get.

The app is organised around tasks now

Every page opens as a grid of the jobs it can do, each with a one-line
explanation. No more toolbar buttons that hide four unrelated operations behind
a word like "Membership": Users went from 5 drawers to 15 tiles, Intune's single
"Actions" drawer became three (lock / retire / wipe) so the difference between
them is stated instead of implied by three red buttons side by side.

• Ctrl+K opens the task palette — ~60 jobs in plain language, searchable in
  English and Russian by your own words ("канал", "same access", "пароль"), each
  landing on the exact form that performs it.
• Forms open in place, next to a panel that spells out the Graph rules that
  will bite you: a private channel only accepts existing team members, dynamic
  and Exchange-managed groups cannot be changed through Graph, removing the last
  license deletes the mailbox after ~30 days.
• A per-page view switch — Actions / Both / Data — decides whether the tiles
  or the raw result pane leads. The table, JSON and tree views are unchanged;
  they are just no longer the whole screen. The choice is remembered per page.
• Every write reports on its tile and stays there, instead of a toast that
  disappears in five seconds. Clear result returns to the tiles.

Playbooks got the same treatment

Onboarding and offboarding are two tiles instead of two tabs, so the report of a
run no longer disappears when you look at the other flow. Fields are labelled
instead of relying on placeholders, the sign-in name autocompletes the tenant
domains, and the warnings that matter (license removal kills the mailbox,
wiping is irreversible, deleting takes the mailbox and OneDrive with it) appear
next to the form the moment you tick the option that causes them.

• Role profiles — save the licenses, groups, teams and channels of a role
  under a name ("Support L1") and apply them to the next hire in one click.
  Offboarding keeps its two built-in phase presets.
• Channels from several teams at once — the selection now accumulates across
  teams instead of resetting each time you pick a different one.

Offboarding finishes the job

Two steps that used to be left to whoever noticed:

• Hand the groups and teams over. Give the leaver's owned groups a new owner
  and drop the leaver — in that order, so nothing is ever left ownerless. Owned
  applications and service principals are deliberately untouched.
• Cancel the meetings they organise. Future meetings with attendees are
  cancelled with a notice ("the organizer has left the organization"); solo
  appointments are simply deleted. Meetings they only attend belong to somebody
  else and are left alone.

Both are options on the offboarding form, each reported as its own step.

One place for "what did this app do"

The local action log moved into Run history as a second tab, next to the
multi-step runs. Two journals in two different menu entries was one too many.

Access mirror

"Give Bell the same access Whitfield has" is one screen now. It reads both
people's groups, admin roles, teams, private and shared channels and licenses,
shows the difference, and copies only what the target is missing.

• Additive only — nothing is ever removed from the target.
• Private channels bring their team along automatically.
• Dynamic and Exchange-managed groups are reported as failed steps with the
  reason, never silently skipped.
• Typed confirmation of the target before anything is granted; the whole run is
  journalled and lands in the local audit log.
• The comparison shows what only the target has, too — you should know when
  someone is carrying access nobody else has.

Audit that answers the question

"Why can this person not sign in?" is a tile: one user's sign-ins, failures
first, over a chosen window, with the Entra error behind each row. Directory
changes can be filtered by the person who made them. Previously both were a
fixed dump of the last 50 events.

Everything tells you what it is doing

Every long operation now says so: a spinner and a live line in the page header
(visible in all view modes), the current stage for multi-step scans ("Source ·
channels of Intermark Team (3/12)"), a cancel button, and buttons that refuse a
second click instead of failing with "an operation is already running".

The long-running pages speak the same language now

Offboarding, Cleanup, Bulk / CSV and Usage reports are tiles too, with their live
console and report in the data pane:

• Offboarding — "how much data does this person have?" and "copy their
  OneDrive to another account" are separate tiles; the backup pool has its own.
  Source and target are picked by name instead of typed.
• Cleanup — the version-history scan and the duplicate scan are two tiles
  instead of a tab strip, each stating what it will do to your data.
• Bulk / CSV — three tiles, one per operation, instead of a dropdown; the
  chosen tile decides which columns the CSV is validated against.
• Usage reports — five tiles named after the question they answer ("who eats
  the OneDrive storage") rather than the Graph report id.
• Security review — a Conditional Access policy is shown as what it actually
  does: who it applies to, who is excluded, which apps and client apps, what it
  demands (MFA, a compliant device, or a block), and its risk levels. The raw
  JSON is still there, folded away. Enterprise app consents keep their split
  between delegated and application permissions, with the warning that the
  latter act without any signed-in user.

Smaller things that were quietly wrong

• Licensing was the last page on the old two-pane layout and made you paste a
  SKU GUID; licenses are now picked by product name with seats used/left.
• Bulk / CSV accepts license and group names — license and group
  columns replace skuId and groupId, resolved once before the run so a typo
  fails immediately instead of after twenty half-applied rows.
• BitLocker keys are fetched per device instead of dumping the tenant's keys.
• Files can act on an item straight from a listing ("Use this ID").
• Reports say what they truncate ("Showing 200 of 4,318 rows…"), and their
  names and periods are translated.
• Dashboard numbers are clickable.
• A Graph collection that came back empty could crash the page it landed on —
  a Go service returning a nil slice marshals to null, and the first .map()
  over it threw. Every list response is normalised to an array now.
• Cleanup no longer fails with 400 Request_BadRequest on a UPN containing
  an apostrophe, a leading $ or the guest #EXT# marker — deep drive paths are
  built from the object id.
• Hundreds of hardcoded English strings in Teams, Chats, Mail, Files, Intune,
  Audit, Licensing and the shared pickers now go through i18n.

Upgrade notes

• No configuration changes. Profiles, secrets and the run journal are untouched.
• The mirror feature needs no new Graph permissions beyond what the copied kinds
  already require (GroupMember.ReadWrite.All, TeamMember.ReadWrite.All,
  ChannelMember.ReadWrite.All, RoleManagement.ReadWrite.Directory,
  User.ReadWrite.All).
• Ownership transfer needs Group.ReadWrite.All; cancelling meetings needs
  Calendars.ReadWrite. Both steps are opt-in on the offboarding form.
• The Activity menu entry is gone — the same log is the second tab of Run
  history.
• Filtered sign-in queries need AuditLog.Read.All, as before.