v1.10.2

• Fix: typed confirmations (REVOKE, APPLY, ADDADMIN, ...) no longer
  close silently on a wrong or lowercase word, which could read as the
  operation having run. The modal now stays open, shows "Did not match"
  and clears the field; only Esc/Ctrl+C cancel.
• Fix: OneDrive admin preflight failed with expected exactly one business drive bound to site ... found 2 on OneDrives holding a second document
  library (Site Assets, migration leftovers, user-created libraries). The
  owner drive is now pinned to the personal library (list template 700,
  MySiteDocumentLibrary) via sharepointIds.listId, in addition to the
  site and web GUIDs.
• Perf: verified at 100k targets. Session cache serialization used $arr +=
  (quadratic: ~20 s per save at 100k, and it ran after every scanned
  target); now linear (~0.5 s) and, inside scan/revoke loops, throttled to
  one save per 10 s plus a final save when the run ends or is cancelled.
  Search filters the previous result while you type (15 ms/keystroke at
  100k) and uses literal substring matching instead of -like (wildcards
  *?[ in the search box are now matched literally). Sorting uses a
  precomputed key array (Findings sorts numerically, ties broken by URL),
  ~5x faster than Sort-Object. Remaining per-item pipelines in revoke
  status recompute, the R finding collector, the findings F filter
  cycle, and OneDrive provisioning user filters replaced with single passes.
• Perf: large lists (15k+ sites/OneDrives, thousands of findings) were near
  unresponsive - every redraw ran six Where-Object passes over all targets
  for the row-3 counts (~1.2 s per arrow key at 15k), and every search
  keystroke re-filtered through chained pipelines (~0.5 s). Counts and
  filters now run as single foreach passes (~20 ms / ~65 ms); tenant
  enumeration and aggregate findings no longer build arrays with +=.

v1.10.2-rc.3

• Fix: OneDrive admin preflight failed with expected exactly one business drive bound to site ... found 2 on OneDrives holding a second document
  library (Site Assets, migration leftovers, user-created libraries). The
  owner drive is now pinned to the personal library (list template 700,
  MySiteDocumentLibrary) via sharepointIds.listId, in addition to the
  site and web GUIDs.

v1.10.2-rc.2

• Perf: verified at 100k targets. Session cache serialization used $arr +=
  (quadratic: ~20 s per save at 100k, and it ran after every scanned
  target); now linear (~0.5 s) and, inside scan/revoke loops, throttled to
  one save per 10 s plus a final save when the run ends or is cancelled.
  Search filters the previous result while you type (15 ms/keystroke at
  100k) and uses literal substring matching instead of -like (wildcards
  *?[ in the search box are now matched literally). Sorting uses a
  precomputed key array (Findings sorts numerically, ties broken by URL),
  ~5x faster than Sort-Object. Remaining per-item pipelines in revoke
  status recompute, the R finding collector, the findings F filter
  cycle, and OneDrive provisioning user filters replaced with single passes.

v1.10.2-rc.1

• Perf: large lists (15k+ sites/OneDrives, thousands of findings) were near
  unresponsive - every redraw ran six Where-Object passes over all targets
  for the row-3 counts (~1.2 s per arrow key at 15k), and every search
  keystroke re-filtered through chained pipelines (~0.5 s). Counts and
  filters now run as single foreach passes (~20 ms / ~65 ms); tenant
  enumeration and aggregate findings no longer build arrays with +=.

v1.10.1

• Fix: secondary-admin Add/Remove (M) sat on a blank screen after the UPN
  prompt while it connected to the admin site, resolved the account, and
  ran a connect + admin read against every selected OneDrive. A spinner and
  progress modal now cover that whole stretch, per-target, and Esc during
  preflight aborts before the confirmation step.
• UI: row-3 context values (selected count, filter, sort, search, scan
  counts, cache time) are color-highlighted so they stand out from labels.
• Fix: pre-provision (P) showed no progress modal after the browser
  sign-in - the modal was only painted when a 200-user batch finished, so
  a single-batch run looked frozen. The modal and spinner now appear
  before the first request, and the Graph/personal-site loading phase
  runs under the spinner too.
• Fix: loading the OneDrives tab and the unprovisioned pre-check paged
  through every site collection in the tenant (the CSOM Include personal
  site filter adds OneDrives on top of regular sites), so the progress
  counter showed the total site count and the load was far slower than
  needed. Personal sites are now requested server-side by template
  (SPSPERS), and the Sites tab explicitly excludes them.

v1.10.1-rc.3

• Fix: secondary-admin Add/Remove (M) sat on a blank screen after the UPN
  prompt while it connected to the admin site, resolved the account, and
  ran a connect + admin read against every selected OneDrive. A spinner and
  progress modal now cover that whole stretch, per-target, and Esc during
  preflight aborts before the confirmation step.
• UI: row-3 context values (selected count, filter, sort, search, scan
  counts, cache time) are color-highlighted so they stand out from labels.

v1.10.1-rc.2

Fix: pre-provision (P) showed no progress modal after the browser sign-in - the modal was only painted when a 200-user batch finished, so a single-batch run looked frozen. The modal and spinner now appear before the first request, and the Graph/personal-site loading phase runs under the spinner too.

Includes rc.1: OneDrive enumeration filtered server-side by template (SPSPERS); Sites tab excludes personal sites.

v1.10.1-rc.1

Fix: OneDrives tab load and unprovisioned pre-check paged through every tenant site (CSOM Include personal-site filter adds OneDrives on top of regular sites), so the progress counter showed the total site count and loads were much slower than needed. Personal sites are now requested server-side by template (SPSPERS); Sites tab explicitly excludes them.

v1.10.0

• Add: OneDrive pre-provisioning (P, OneDrives tab). Loads every enabled
  member user with an Enabled SharePoint service plan whose personal site
  does not exist yet (diff of Graph /users against the tenant's personal
  sites, by owner UPN and /personal/<slug>) as rows under a new
  Unprovisioned filter (F cycle, OneDrives tab only; the rows never
  appear under All) with an orange ! badge. Select rows with Space/A,
  press P, type PROVISION, and only the selection is submitted via
  Request-PnPPersonalSite in batches of 200; those rows switch to
  Requested. Placeholder rows are skipped by scans, revoke and admin
  actions and are not saved to the session cache. Enter on an empty
  Unprovisioned view loads them too. Evidence:
  SSM_ONEDRIVE_UNPROVISIONED_<stamp>.csv (when at least one user is
  found) and SSM_ONEDRIVE_REQUESTED_<stamp>.csv (Upn, Batch, Status, Error).
• Note: the provisioning request itself runs on a separate interactive
  sign-in. The service authorizes personal-site provisioning only for
  tokens carrying the SharePoint scope AllProfiles.Manage, which exists
  solely on Microsoft's first-party SharePoint Online Management Shell app;
  app-only certificate tokens and delegated tokens from a custom app are
  rejected with "Attempted to perform an unauthorized operation"
  (pnp/powershell#4329). After PROVISION a browser sign-in opens via that
  client id (9bc3ab49-b65d-410a-85ad-de819febfddc) on the tenant admin
  site; sign in as a SharePoint Administrator. The connection is kept for
  the session; the tool's own connection is unchanged. No extra app
  permission is needed. Live-validated by an operator against an app-only
  tenant.
• Change: Get-TenantTargets paging loop factored into
  Get-SsmTenantSiteProperties (shared with the personal-site owner set);
  no behaviour change.
• Docs: new wiki page OneDrive-Pre-Provisioning; Authentication,
  Requirements, README and help updated.

v1.10.0-rc.6

• Fix: after the browser sign-in for OneDrive provisioning the terminal
  stayed black until the summary appeared. The main buffer now shows what
  is happening during the sign-in, and the screen is repainted before the
  batch progress is drawn.