2.6.0

Release roll-up introducing a redesigned assessment report experience, expanded Security Operations and Network coverage, stronger privacy protections for diagnostics, and updated Zero Trust Workshop integration and guidance.

Install from PowerShell Gallery:

Install-Module -Name ZeroTrustAssessment -RequiredVersion 2.6.0

📊 Report experience

• A redesigned report is now generated as ZeroTrustAssessmentReport.html and opened by default.
• The previous report remains available alongside it as ZeroTrustAssessmentReport-classic.html.
• The overview now includes AI agent counts and recent active agent users.
• Device insights now include operating-system distribution, desktop join and compliance state, mobile compliance, ownership, and managed-device summaries.
• New Network visualizations show how Azure workloads are protected across inbound, outbound, and availability defense planes.
• Report generation now validates template paths and embedded-data markers, with improved temporary-file handling.

🛡️ Security Operations assessments

Microsoft Defender for Office 365 and collaboration protection

• 41033 — Anti-phishing policies in Microsoft Defender for Office 365 are configured with impersonation and spoof protection
• 41034 — Anti-spam (hosted content filter) policies are configured with recommended thresholds and actions
• 41114 — Microsoft Teams protection policies are configured to block malicious messages, links, and attachments
• 41116 — Threat hunting against Email and Collaboration tables in Microsoft 365 Defender Advanced Hunting is operational

Endpoint and application control

• 41052 — Application control (WDAC / App Control for Business) is enforced via Intune

Microsoft Sentinel and Security Copilot

• 41209 — User and Entity Behavior Analytics (UEBA) is enabled in Microsoft Sentinel
• 41211 — Auditing and health monitoring is enabled for Microsoft Sentinel
• 41215 — Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenant

🌐 Network coverage

• 25375 — The tenant holds the licenses required to operate Global Secure Access
• 27024 — HTTP DDoS protection rule set is enabled in Azure Front Door WAF
• Added report insights for Azure inbound, outbound, and availability defense planes.

✅ Pillars and assessment metadata

• Infrastructure, Security Operations, and AI have moved out of preview. All current pillars now run by default without requiring -Preview.
• The -Preview switch remains available for future preview-only functionality.
• Assessment 35037 was retired because it cannot be evaluated reliably by the assessment framework. (#1434)
• Updated Secure Future Initiative pillar mappings and implementation metadata for assessments 21835, 24550, and 24552.

🔒 Privacy and diagnostic safety

• Added defense-in-depth sanitization before error details are persisted to reports, logs, or test results. (#1426)
• Credential-bearing HTTP headers, sensitive values, response bodies, and unsafe target objects are excluded from persisted diagnostics.
• Failed tests now use bounded, structured diagnostic summaries containing safe fields such as request method and path, HTTP status, Graph error code, correlation IDs, exception type, and source location.

🧩 Zero Trust Workshop integration

Assessment results now generate a ready-to-import Zero Trust Workshop notes file at <output folder>\zt-export\ZeroTrustWorkshop.json. Take this file and import it directly into the Zero Trust Workshop at aka.ms/zerotrust/workshop.

📚 Workshop guidance and documentation

• Added comprehensive DevSecOps Workshop guidance.
• Expanded Workshop guidance for AI, Devices, and Network tasks.
• Added and refreshed AI, Assessment, Devices, and DevSecOps videos.
• Updated the Workshop and Assessment site experience, screenshots, delivery guidance, and version history.
• Updated module documentation for the new default pillars and dual report outputs.