3.1.0

Release roll-up expanding Security Operations and Network coverage, adding new report insights, and improving data collection for larger tenants.

Install from PowerShell Gallery:

Install-PSResource -Name ZeroTrustAssessment -Version 3.1.0

⬆️ Upgrade requirements

• PowerShell 7.6 or later is required.

📊 Report experience

• Added a Microsoft 365 protection circuit that shows Global Secure Access traffic acquisition and compliant-network enforcement as separate stages.
• Added a Private Access posture funnel showing app segmentation, strong authentication, and Application Administrator assignments.
• Added Data insights for DLP policy coverage across Exchange, SharePoint, OneDrive, Teams, Endpoint, and Copilot, and sensitivity-label protection across classification, visual marking, encryption, and Double Key Encryption.
• Added Infrastructure insights showing open Microsoft Defender for Cloud recommendations by severity, plus a weighted Cloud Secure Score overview across supported Azure, AWS, GCP, and developer/container environments.
• Expanded device insights with Microsoft Defender for Endpoint sensor coverage by operating system and an antivirus protection summary.
• Added an AI-agent ownership and sponsor distribution to help identify agents without an owner, sponsor, or both.
• Refined the Azure network security planes and secure web gateway defense-layer visualizations.

🛡️ Security Operations assessments

Directory and privileged access

• 41004 — Privileged Active Directory accounts are marked as sensitive and cannot be delegated.
• 41008 — Local administrator passwords on identity assets are protected with Microsoft LAPS.
• 41011 — Non-administrative accounts do not have domain-controller replication permissions.
• 41012 — The Microsoft Entra Connect synchronization account does not have unnecessary replication permissions.

Email and collaboration

• 41035 — User reports of phishing and spam are routed to a reviewed mailbox.
• 41036 — Attack Simulation Training is configured and a baseline simulation has run within the last 12 months.
• 41039 — Zero-hour auto purge is enabled for malware, phishing, and spam in email.
• 41040 — Tenant Allow/Block List allow entries are reviewed for expiration, justification, and staleness.

Endpoint protection

• 41049 — The Microsoft Defender Antivirus user interface is hidden from end users.
• 41050 — Attack surface reduction rules are enabled in block mode.
• 41051 — Removable storage and device-control policies are enforced through Intune.
• 41054 — Controlled folder access is enabled in block mode.
• 41055 — Microsoft Defender Antivirus real-time, behavioral, and heuristic protections are enabled.
• 41119 — Local modification of Microsoft Defender Antivirus policy is blocked.

Cloud app session controls

• 41080 — Conditional Access App Control session policies are enabled for cloud apps.
• 41083 — Step-up authentication is required for risky in-session actions.

Microsoft Sentinel and Security Copilot

• 41201 — Each Sentinel-onboarded workspace has a Microsoft first-party data connector.
• 41202 — Third-party data connectors are configured for in-scope non-Microsoft workloads.
• 41203 — Custom connectors are configured for in-scope sources without a built-in connector.
• 41204 — Workspace interactive and total retention meet the security baseline.
• 41205 — Data collection rules control ingestion into Sentinel workspaces.
• 41210 — Microsoft Threat Intelligence indicators are integrated into Sentinel.
• 41212 — Sentinel hunting is operationalized with saved queries or bookmarks.
• 41214 — A Sentinel automation rule runs a playbook for automated threat response.
• 41216 — Security Copilot capacity consumption is monitored and alerted on through Cost Management.
• 41217 — Sentinel security tables use an appropriate Analytics, Basic, or Auxiliary storage plan.

🌐 Network and AI Gateway assessments

• 25412 — Global Secure Access threat-intelligence filtering protects internet traffic from malicious destinations.
• 27028 — A web content filtering policy on the Global Secure Access baseline profile governs Copilot Studio agent traffic.

📈 Performance improvement efforts

These improvements address performance and stability concerns raised in #1236 and related large-tenant feedback.

• Graph request handling: Batched Graph GET requests now use the shared batch-request helper, with more consistent paging, throttling and transient-error retries, and dependency recovery. Checks that retrieve data for many principals can make fewer individual network round trips, while recovery behavior is more consistent.
• Export pipeline: Export queries now select smaller field sets for applications, users, sign-in logs, service principals, and privileged-group members. Role-assignment and eligibility schedule-instance exports request principal IDs first, resolve only the fields needed for assessment processing in batches, and cache results across pages. Page reconciliation updates saved exports without keeping all pages in memory. Together, the export configuration and model changes reduce response size, repeated lookups, and memory/serialization work.
• DuckDB resource cleanup: Database query commands and readers are now disposed in a finally block, including when result processing fails. This prevents query resources from accumulating during long or repeated assessments.
• Existing assessment refinements: Existing checks were optimized or corrected across authentication and privileged access (21801, 21814, 21818), guest ownership and sponsorship (21868, 21877), Global Secure Access and Private Access (25376, 25384, 25395, 25396), Defender for Cloud recommendations (50001), and Copilot agent discovery and sign-in evidence (61005, 61011). These changes include using exported data for local role analysis, limiting policy checks to privileged roles, bounding report detail, and improving result handling for incomplete or mismatched data. Some refinements improve correctness and report clarity rather than runtime speed.
• Expanded Pester coverage for Graph batching and retries, export behavior, report data, telemetry, and the updated assessments to guard against regressions. The tests improve change confidence; they are not themselves runtime optimizations.

Assessments of large tenants may still take a long time. The goal is reliable completion: tenant size or a long runtime alone should not cause the assessment to break or fail. For larger tenants, an appropriately sized dedicated Windows VM with sufficient CPU and memory is still recommended. See the dedicated clean VM guidance.

🔒 Telemetry and demo-report safety

• Added a run-time telemetry notice that explains the event payload and the -DisableTelemetry switch. The event contains the tenant ID as its only tenant-specific custom property and does not include assessment results; standard network metadata may still be processed by Azure Monitor or intervening network services.
• Reworked demo-report generation to replace tenant-specific identities and resource details with synthetic values, validate the generated report data and HTML, and verify anonymization before publishing demo outputs.

📚 Documentation and maintenance

• Updated the PowerShell guide, troubleshooting guidance, and report screenshots, and added a Zero Trust Workshop pitch deck.
• Added a repository verification script and development conventions, refreshed the build and release scripts for the current PowerShell requirements, and pinned GitHub Actions to full commit SHAs.

Full changelog