Update V3.0.2 - Updates & Improvements

New Features & Improvements:

• Implemented a Graph-based variant for collecting OAuth applications: Get-OAuthPermissionGraph (credit to @evild3ad).
• Added -encoding flag to Message Trace and Activity Directory logs (thanks to @pgarcia-ncd for the contribution).
• Introduced -OutputDir option to Start-EvidenceCollection, requested by @DoubtfulTurnip.
• Updated the Prerequisites page in Read The Docs with improvements.
• Added MaxItemsPerInterval to Get-UAL, allowing users to specify the maximum number of items processed per interval (range: 5000–50000).
• Added Get-OAuthPermissionGraph to the automatic collection when running Start-EvidenceCollection.

Bug Fixes:

• Get-MailItemsAccessed.ps1 now strictly accepts Yes/No for the -Output field to prevent errors from entering just Y.

• Resolved an issue with the -MergeOutput flag in Get-UAL when selecting a group (reported by @Matthijsy).

• Fixed a bug in the Microsoft cmdlet’s beta variant that caused missing log types (nonInteractiveUser, servicePrincipal, and managedIdentity) (microsoftgraph/msgraph-sdk-powershell#2753). The filter now ensures all event types are collected correctly.

• Sign-in logs collection via Graph now generates separate files for:

  • servicePrincipal
  • interactiveUser + nonInteractiveUser
  • ManagedIdentity