IntuneAssignmentChecker v4.3.1

Security

IntuneAssignmentChecker now uses GroupMember.Read.All instead of the broader Group.Read.All permission for group lookup, direct membership, and transitive membership operations. This preserves the assignment-checking behavior while removing access to Microsoft 365 group content.

Compatibility

There are no changes to public commands, parameters, output formats, or Microsoft Graph membership endpoints.

Interactive connections automatically request the delegated GroupMember.Read.All permission on the next sign-in. Administrator consent is still required.

Certificate, client secret, managed identity, and pre-fetched token connections cannot change their own application permissions. Existing app-only registrations require the migration below.

Upgrade steps for app-only registrations

1. Add the Microsoft Graph application permission GroupMember.Read.All.
2. Grant administrator consent.
3. Update IntuneAssignmentChecker to v4.3.1.
4. Run the normal user, device, and group assignment checks to confirm access.
5. Remove Group.Read.All from configured API permissions and revoke its service principal application-role grant.

Updating requiredResourceAccess alone might not remove an existing tenant consent grant, so verify the old role is actually revoked.

Hidden memberships

Member.Read.Hidden remains optional. Add it only when IntuneAssignmentChecker must resolve groups configured with hidden membership.

Reliability

The release adds regression tests for the least-privilege permission contract and the existing paginated transitive group membership path. The complete 162-test unit suite passes on Windows, macOS, and Linux.