diff --git a/CHANGELOG.md b/CHANGELOG.md index 05b7a8d..8687e6c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,45 @@ All notable changes to this project will be documented in this file. The format follows [Conventional Commits](https://www.conventionalcommits.org/) and this project adheres to [Semantic Versioning](https://semver.org/). Release notes for each version are also generated from git history by the automation pipeline using the same conventional types (feat, fix, docs, refactor, test, etc.). +## [1.1.0] + +### Features + +- New `Get-CustomSecurityAttributesReport` cmdlet with auto-discovery of attribute sets across users, devices, and enterprise applications. +- Shared HTML report template (`Get-RKSolutionsReportTemplate`) with rksolutions.nl branding, Geist/Geist Mono typography, pill-style tabs, and neutral dark theme. +- All 5 reports migrated to shared template, eliminating duplicated HTML/CSS/JS. +- Light/dark theme support for table backgrounds. +- DataTable column widths recalculate on tab switch. + +### Security + +- HTML-encode all Graph API data before HTML interpolation across all report generators (stored XSS prevention). +- Fix JavaScript filter dropdown injection — use jQuery DOM API instead of string concatenation. +- Validate `-From` parameter as email address or GUID in `Send-EmailWithAttachment`. + +### Fixes + +- Replace quadratic `$array +=` patterns with `List[PSObject].Add()` in M365License and CustomSecurityAttributes. +- Add `Write-Verbose` to empty catch blocks in IntuneEnrollmentFlows for diagnostics. +- Add `Write-Warning` when Graph paging silently caps results at 10,000 items. +- Fix report file deletion before confirming email was sent in `Get-IntuneAnomaliesReport`. +- Guard undefined `$mermaidDiagram` variable with null-check. +- Fix typo `OperationSystemEdtionOverview` to `OperatingSystemEditionOverview`. +- Fix double-encoded `→` HTML entity in PIM Audit Logs. +- Sanitize tenant name in export file paths. +- Use unique temp file instead of hardcoded `C:\temp` path. +- Initialize `$emailSent` before conditional block. +- Remove dead OS detection variables in `Export-Results`. +- PIM Audit Logs: fix column widths with `table-layout:fixed`. +- M365 License: replace assignment type color badges with plain text. + +### Maintenance + +- Remove unused `$Filters` and `$AttributeNames` parameters from `Get-CustomSecurityAttributeData`. +- Add `CustomSecAttributeAssignment.Read.All` and `CustomSecAttributeDefinition.Read.All` scopes. + +--- + ## [1.0.0] - (initial) ### Features diff --git a/README.md b/README.md index a8f10f7..d4a0ee8 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ [CI](https://github.com/royklo/RKSolutions-Module/actions) [License: MIT](LICENSE) -PowerShell module for Microsoft Graph–backed reports: Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, and M365 License Assignment. Connects to Microsoft Graph and generates HTML/CSV reports. +PowerShell module for Microsoft Graph–backed reports: Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, M365 License Assignment, and Custom Security Attributes. Connects to Microsoft Graph and generates interactive HTML reports. ## About @@ -74,6 +74,7 @@ Get-IntuneEnrollmentFlowsReport -AssignmentOverviewOnly Get-IntuneAnomaliesReport Get-EntraAdminRolesReport Get-M365LicenseAssignmentReport +Get-CustomSecurityAttributesReport # Disconnect when done Disconnect-RKGraph @@ -89,6 +90,7 @@ Disconnect-RKGraph | **Get-IntuneAnomaliesReport** | Generates Intune anomalies report. | | **Get-EntraAdminRolesReport** | Generates Entra admin roles report. | | **Get-M365LicenseAssignmentReport** | Generates M365 license assignment report. | +| **Get-CustomSecurityAttributesReport** | Generates Custom Security Attributes report across users, devices, and apps. | For full parameter details and examples, see **[Cmdlet Reference](docs/CMDLET-REFERENCE.md)**. diff --git a/docs/CMDLET-REFERENCE.md b/docs/CMDLET-REFERENCE.md index 5c48250..d032f9d 100644 --- a/docs/CMDLET-REFERENCE.md +++ b/docs/CMDLET-REFERENCE.md @@ -112,4 +112,28 @@ Connect first with **Connect-RKGraph**; this cmdlet uses the existing connection --- +## Get-CustomSecurityAttributesReport + +Generates an interactive HTML report of custom security attributes across users, devices, and enterprise applications. Auto-discovers attribute sets or accepts a specific set. + + +| Parameter | Description | +| --------------- | ---------------------------------------------------------------------------- | +| **AttributeSet** | Specific attribute set to report on. If omitted, discovers and reports all. | +| **SendEmail** | Send report by email. | +| **Recipient** | Email recipient(s). | +| **From** | From address. | +| **ExportPath** | Output file path. | +| **DebugMode** | Enable debug output. | + +Connect first with **Connect-RKGraph**; this cmdlet uses the existing connection (no auth parameters). + + +**Examples:** +- `Get-CustomSecurityAttributesReport` — auto-discover all attribute sets +- `Get-CustomSecurityAttributesReport -AttributeSet "ComplianceData"` — specific set only +- `Get-CustomSecurityAttributesReport -SendEmail -Recipient "admin@contoso.com"` — generate and email + +--- + For full parameter sets and examples, run `Get-Help -Full` in PowerShell. \ No newline at end of file diff --git a/docs/PERMISSIONS.md b/docs/PERMISSIONS.md index 82c6be0..8774412 100644 --- a/docs/PERMISSIONS.md +++ b/docs/PERMISSIONS.md @@ -12,6 +12,7 @@ Use these when registering an app in Azure AD / Entra ID or when calling `Connec |------------|---------| | **AuditLog.Read.All** | Get-EntraAdminRolesReport, Get-M365LicenseAssignmentReport | | **CustomSecAttributeAssignment.Read.All** | Get-CustomSecurityAttributesReport | +| **CustomSecAttributeDefinition.Read.All** | Get-CustomSecurityAttributesReport | | **CloudLicensing.Read** | Get-M365LicenseAssignmentReport | | **CloudPC.Read.All** | Get-IntuneEnrollmentFlowsReport, Get-IntuneAnomaliesReport | | **Device.Read.All** | Get-IntuneEnrollmentFlowsReport | @@ -57,6 +58,7 @@ Default `-RequiredScopes` is the **union** of all scopes below so one connection - CloudLicensing.Read - CloudPC.Read.All - CustomSecAttributeAssignment.Read.All +- CustomSecAttributeDefinition.Read.All --- @@ -115,6 +117,7 @@ Default `-RequiredScopes` is the **union** of all scopes below so one connection ### Get-CustomSecurityAttributesReport - CustomSecAttributeAssignment.Read.All +- CustomSecAttributeDefinition.Read.All - User.Read.All - Organization.Read.All - Mail.Send diff --git a/module/README.md b/module/README.md index 9ffba3e..137b9bf 100644 --- a/module/README.md +++ b/module/README.md @@ -1,6 +1,6 @@ # RKSolutions PowerShell Script Module -This is the script implementation of the RKSolutions module. It provides cmdlets to connect to Microsoft Graph and generate reports for Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, and M365 License Assignment. +This is the script implementation of the RKSolutions module. It provides cmdlets to connect to Microsoft Graph and generate reports for Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, M365 License Assignment, and Custom Security Attributes. > **Requires PowerShell 7.0 or higher.** Windows PowerShell 5.1 is not supported. @@ -17,7 +17,8 @@ module/ │ ├── Get-IntuneEnrollmentFlowsReport.ps1 │ ├── Get-IntuneAnomaliesReport.ps1 │ ├── Get-EntraAdminRolesReport.ps1 -│ └── Get-M365LicenseAssignmentReport.ps1 +│ ├── Get-M365LicenseAssignmentReport.ps1 +│ └── Get-CustomSecurityAttributesReport.ps1 └── Private/ # Helpers (not exported; used internally by Public cmdlets) ├── Connect-ToMgGraph.ps1 ├── Invoke-RKSolutionsWithConnection.ps1 @@ -26,10 +27,12 @@ module/ ├── ConvertTo-DateString.ps1 ├── Install-Requirements.ps1 ├── Export-Results.ps1 + ├── Get-RKSolutionsReportTemplate.ps1 ├── IntuneEnrollmentFlows.ps1 ├── IntuneAnomalies.ps1 ├── EntraAdminRoles.ps1 - └── M365License.ps1 + ├── M365License.ps1 + └── CustomSecurityAttributes.ps1 ``` ## Loading the script module