v4.3.0 - Excluded Apps in Group Checks, Shared Scan Engine

Highlights

• Excluded apps now visible in group checks (#126): Get-IntuneGroupAssignment shows applications where the checked group is excluded, bucketed by the excluding assignment's intent with reason "Group Exclusion" or "Inherited Exclusion (via X)". Compare-IntuneGroupAssignment marks excluded apps with [EXCLUDED].
• Shared category-scan engine (#123): the ten category-walk cmdlets were rebuilt on one engine. Entity sets are fetched once per run (dozens fewer Graph calls), transient per-category failures no longer abort a run, and failures are raised on the error stream for automation scenarios.
• Bug fixes (#123): App Protection policies no longer appear for every user regardless of group membership; app install intent is taken from the winning assignment; multi-device input works again; CSV exports no longer contain junk rows; group memberships, group comparisons, and assignment failure reports paginate past 100 items; Get-IntuneEmptyGroup now actually checks App Protection and endpoint security categories; EDR policies appear in HTML reports again; Switch-Tenant connects with the correct scopes and refreshes cached lookups; selecting exit in the environment menu no longer terminates the PowerShell session; guest user UPNs containing # resolve correctly.
• Security hardening (#123): HTML report values are HTML-encoded, group-name OData filters escape quotes, and Connect-IntuneAssignmentChecker accepts -ClientSecretCredential (PSCredential) as the preferred client secret input (plain-string -ClientSecret retained for compatibility).
• Docs and setup alignment (#124): README documents all four authentication options including pre-fetched access tokens, and Register-IntuneAssignmentCheckerApp.ps1 grants the full documented permission set, uses a cross-platform temp path, and removes its temporary client secret if certificate upload fails.

Note on endpoint security intents (#125)

The legacy deviceManagement/intents fallback is deliberately retained: live verification found assigned macOS endpoint security policies (FileVault) that exist only as intents because the Microsoft migration to configurationPolicies covered Windows policies only. The fallback is now centralized so intents are fetched once per run instead of repeatedly per category.

Install

Install-Module IntuneAssignmentChecker -Scope CurrentUser
# or upgrade
Update-Module IntuneAssignmentChecker