DUDE Manager v1.8.0

This release adds browser sign-in, startup update checks, a true-black theme, and Azure PowerShell 7.6 support for Function Apps.

Includes DUDE Runtime v13.17.5, unchanged from the previous release.

Added

• Startup update check: checks GitHub for newer Manager and Runtime versions and links to the releases page. Nothing is downloaded or installed. Disable with DUDE_UPDATE_CHECK=0.
• Browser sign-in: interactive browser authentication on Windows x64 and Windows on ARM.
• Azure PowerShell 7.6: new Windows Function Apps request PowerShell 7.6. Deploy upgrades eligible Windows Functions 4 apps from 7.4 after compatibility checks, followed by configuration readback. Stack changes restart the app; readback confirms configuration, not runtime compatibility.
• Table sort indicators: column headers show the current sort direction.

Changed

• True-black theme: refreshed backgrounds, cards, buttons, hover and disabled states, tooltips, and a more compact header.
• Updated screenshots: all five tabs are illustrated with fictitious demo data.

Fixed

• Discover can find a uniquely named Azure Table containing “DUDE” when the default table is absent. Multiple matches require manual selection.
• Discover reports observed issues and distinguishes missing resources from ambiguous or incomplete assessments.
• CachedVerify and Verify show warning completion states for applicable validation warnings.
• Configure and Operations buttons respect row selection and Function App state when entering a tab.
• Alt+C works again after disconnecting.
• Filter labels and radio button text no longer clip at 150% display scaling.
• Cleanup displays a result popup after deletion, including incomplete and failed outcomes.

Removed

• Device-code sign-in. Use browser sign-in instead.

DUDE Manager v1.7.3 + Runtime v13.17.5

Release: DUDE Manager v1.7.3 + DUDE Runtime v13.17.5 — 2026-07-04

Release-blocker closure for the v1.7.x stabilization release. Runtime is unchanged from v13.17.5.

DUDE Manager (GUI/Module) — v1.7.3

Fixed

• Tenant switch reset uses captured UI/config state: cached-tenant switch completion now resets old-tenant resources through the captured connection state instead of resolving stale script-scope objects inside the dispatcher callback.
• Configure bulk edit/delete callbacks resolve helpers safely: Configure tab background timers now capture async-state helper commands before entering dispatcher closures, preventing private-helper lookup failures after successful background work.
• Operations fallback log messages use the RichTextBox writer: Operations fallback messages now route through the shared log text helper instead of assigning .Text on a RichTextBox.
• Cached validation success only appears after successful validation: the cached-validation completion popup is now gated on an actual successful validation result.
• Posture is gated during setup validation/discovery: Posture can no longer start while cached validation or infrastructure discovery is mutating setup context.
• Posture locks with infrastructure actions: Verify and Deploy now disable the Posture tab with the other primary tabs, and stale Verify/Deploy callbacks now clean up their background resources without re-enabling the current UI state.
• Verify fails closed on validation contract violations: infrastructure Verify now treats validation-summary invariant violations as hard failures, matching Deploy, CachedVerify, and Discover.
• Cleanup delete completion ignores stale connection state: destructive cleanup completion now re-checks cleanup connection generation before applying UI refresh after background deletion work, and stale completions keep Cleanup delete targets disabled until resources are refreshed and WhatIf is rerun.
• Cleanup WhatIf enables deletion after a successful preview: WhatIf timer error handling now uses closure-safe sanitized formatter calls so a post-preview UI catch cannot fail before the approved delete button state is applied.
• Cleanup subscription discovery is tenant-scoped: Cleanup subscription loading now queries and filters subscriptions for the connected tenant before populating destructive cleanup targets.
• Cleanup and Operations stale callbacks fail closed: Cleanup subscription-load callbacks are generation-guarded and reset on disconnect; Operations generic refresh catches now stop stale callbacks before they can re-enable controls or queue follow-up refreshes.
• Multi-subscription connect avoids silent first-subscription fallback: one-login connect now prefers the active Az context subscription, allows single-subscription fallback, and fails closed when multiple subscriptions are available but no active subscription matches.
• Dedicated hosting metadata reflects automatic Always On: release metadata and docs now match the Step 7 behavior that enables and repairs Always On for Dedicated plans.
• Operations and Posture keep unknown telemetry distinct from failures: trace-only invocation rows remain Unknown instead of being displayed or counted as failed executions.
• Artifact integrity checking fails closed: release artifact verification now fails on missing or mismatched Function artifacts instead of printing a warning while continuing.

DUDE Runtime — v13.17.5

No runtime changes.

DUDE Manager v1.6.2 + Runtime v13.17.1

DUDE Manager v1.6.2 + Runtime v13.17.1

Hotfix release. Both GUI and Runtime updated to fix Entra group lookup for displayNames containing & and other URL-reserved characters.

Fixed

• Group lookups failed for Entra groups whose displayName contained & (or #, +, ?). Both the Azure Function runtime and the GUI validation cache built Microsoft Graph $filter URLs of the form /groups?$filter=(displayName eq 'Foo & Bar')&$select=... via raw string interpolation. Only single quotes were OData-escaped (' → ''); the & inside the value was parsed by the HTTP layer as a query-parameter separator, truncating $filter and triggering Invalid filter clause: unterminated string literal from Graph. Phase 1 logged [WARN] Failed to lookup user group 'X & Y', then the orchestrator aborted with [ERROR] Failed to fetch required user groups. In the GUI, the Configure-tab Validate falsely reported &-groups as "Does not exist in Entra".

  Added a centralized helper ConvertTo-DUDEGraphFilterLiteral that doubles single quotes (OData v4) and then percent-encodes via [Uri]::EscapeDataString (RFC 3986 — %20 for space, not +).

Affected paths:

• Runtime (3 sites): Get-DUDEUserGroups, Get-DUDEDeviceGroups, Get-DUDEAdminUnits in DUDE.DataFetch.psm1
• GUI (4 sites): Initialize-GroupValidationCache in Test-GroupConfiguration.ps1 + the Configure-tab cache-init runspace in Groups-Handlers.ps1
• Not affected: Microsoft.Graph SDK fallback (Get-MgGroup -Filter ...) — the SDK URL-encodes the filter value itself

Workaround (no longer needed)

Pre-fix workaround was to rename the affected group to remove the special character (e.g. `Sales & Marketing` → `Sales and Marketing`).

Notes

• Runtime redeploy required to pick up the runtime fix (v13.17.1). Use the GUI's Deploy mode to push the updated Function App modules.
• GUI module update required to fix the Configure-tab Validate behavior (v1.6.2).
• Module dependencies unchanged.

DUDE Manager v1.6.1

DUDE Manager v1.6.1

Bugfix release. Runtime unchanged (v13.17.0).

Fixed

• Function App listing crash: Replaced Get-AzFunctionApp with Get-AzWebApp filtered by Kind -like '*functionapp*' across 9 call sites. Get-AzFunctionApp (Az.Functions 4.3.1) enumerates sites subscription-wide and performs client-side SKU mapping that throws ArgumentNullException ("ContainsKey with 1 argument: Value cannot be null") when any site in the subscription has a tier the cmdlet's internal dictionary can't map. Common triggers: Flex Consumption plans, Container Apps-based Function Apps, Logic App Workflow Standard sites, orphan serverFarmId references, or new Azure-side tiers. Get-AzWebApp scopes server-side on the resource group and avoids the SKU mapping entirely.

Affected paths:

• Hydration dropdown population (Setup tab)
• "Use Existing" Function App toggle
• Cleanup scan + App Service Plan dependency check
• Verify mode: Step 6 (App Service Plan), Step 7 (Function App), Function App status, managed identity permission check
• Step 7 auto-created ASP signal

Notes

• Runtime (Azure Function) version unchanged: v13.17.0. No redeploy required.
• Module dependencies unchanged.

DUDE Manager v1.6.0 + Runtime v13.17.0

DUDE Manager — First Public Release

Dynamic User & Device Enumeration (DUDE) — deterministic, prefix-driven user-to-device group sync for Microsoft Intune.

What's included

• DUDE Manager GUI (v1.6.0) — PowerShell + WPF management interface for Azure infrastructure, configurations, and monitoring
• DUDE Runtime (v13.17.0) — Azure Function App that performs the actual sync operations

Highlights

• 12-step infrastructure validation and deployment
• Fail-closed security model with prefix allowlists and blast radius limiter
• Managed Identity for zero-credential runtime
• Optional Defender for Endpoint machine tagging
• Optional Entra ID Administrative Unit sync
• Dark-themed WPF interface with log viewer, bulk edit, CSV import/export
• Support for Consumption, Dedicated, and Premium hosting plans

Getting started

See README.md for prerequisites, setup, and usage.

Documentation

• Architecture
• Security Model
• Privacy
• Troubleshooting
• Contributing