docs: update changelog, readme, cmdlet reference, and permissions for…

CHANGELOG.md

@@ -4,6 +4,45 @@ All notable changes to this project will be documented in this file.
 
 The format follows [Conventional Commits](https://www.conventionalcommits.org/) and this project adheres to [Semantic Versioning](https://semver.org/). Release notes for each version are also generated from git history by the automation pipeline using the same conventional types (feat, fix, docs, refactor, test, etc.).
 
+## [1.1.0]
+
+### Features
+
+- New `Get-CustomSecurityAttributesReport` cmdlet with auto-discovery of attribute sets across users, devices, and enterprise applications.
+- Shared HTML report template (`Get-RKSolutionsReportTemplate`) with rksolutions.nl branding, Geist/Geist Mono typography, pill-style tabs, and neutral dark theme.
+- All 5 reports migrated to shared template, eliminating duplicated HTML/CSS/JS.
+- Light/dark theme support for table backgrounds.
+- DataTable column widths recalculate on tab switch.
+
+### Security
+
+- HTML-encode all Graph API data before HTML interpolation across all report generators (stored XSS prevention).
+- Fix JavaScript filter dropdown injection — use jQuery DOM API instead of string concatenation.
+- Validate `-From` parameter as email address or GUID in `Send-EmailWithAttachment`.
+
+### Fixes
+
+- Replace quadratic `$array +=` patterns with `List[PSObject].Add()` in M365License and CustomSecurityAttributes.
+- Add `Write-Verbose` to empty catch blocks in IntuneEnrollmentFlows for diagnostics.
+- Add `Write-Warning` when Graph paging silently caps results at 10,000 items.
+- Fix report file deletion before confirming email was sent in `Get-IntuneAnomaliesReport`.
+- Guard undefined `$mermaidDiagram` variable with null-check.
+- Fix typo `OperationSystemEdtionOverview` to `OperatingSystemEditionOverview`.
+- Fix double-encoded `→` HTML entity in PIM Audit Logs.
+- Sanitize tenant name in export file paths.
+- Use unique temp file instead of hardcoded `C:\temp` path.
+- Initialize `$emailSent` before conditional block.
+- Remove dead OS detection variables in `Export-Results`.
+- PIM Audit Logs: fix column widths with `table-layout:fixed`.
+- M365 License: replace assignment type color badges with plain text.
+
+### Maintenance
+
+- Remove unused `$Filters` and `$AttributeNames` parameters from `Get-CustomSecurityAttributeData`.
+- Add `CustomSecAttributeAssignment.Read.All` and `CustomSecAttributeDefinition.Read.All` scopes.
+
+---
+
 ## [1.0.0] - (initial)
 
 ### Features

README.md

@@ -4,7 +4,7 @@
 [CI](https://github.com/royklo/RKSolutions-Module/actions)  
 [License: MIT](LICENSE)
 
-PowerShell module for Microsoft Graph–backed reports: Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, and M365 License Assignment. Connects to Microsoft Graph and generates HTML/CSV reports.
+PowerShell module for Microsoft Graph–backed reports: Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, M365 License Assignment, and Custom Security Attributes. Connects to Microsoft Graph and generates interactive HTML reports.
 
 ## About
 
@@ -74,6 +74,7 @@ Get-IntuneEnrollmentFlowsReport -AssignmentOverviewOnly
 Get-IntuneAnomaliesReport
 Get-EntraAdminRolesReport
 Get-M365LicenseAssignmentReport
+Get-CustomSecurityAttributesReport
 
 # Disconnect when done
 Disconnect-RKGraph
@@ -89,6 +90,7 @@ Disconnect-RKGraph
 | **Get-IntuneAnomaliesReport** | Generates Intune anomalies report. |
 | **Get-EntraAdminRolesReport** | Generates Entra admin roles report. |
 | **Get-M365LicenseAssignmentReport** | Generates M365 license assignment report. |
+| **Get-CustomSecurityAttributesReport** | Generates Custom Security Attributes report across users, devices, and apps. |
 
 For full parameter details and examples, see **[Cmdlet Reference](docs/CMDLET-REFERENCE.md)**.
 

docs/CMDLET-REFERENCE.md

@@ -112,4 +112,28 @@ Connect first with **Connect-RKGraph**; this cmdlet uses the existing connection
 
 ---
 
+## Get-CustomSecurityAttributesReport
+
+Generates an interactive HTML report of custom security attributes across users, devices, and enterprise applications. Auto-discovers attribute sets or accepts a specific set.
+
+
+| Parameter       | Description                                                                  |
+| --------------- | ---------------------------------------------------------------------------- |
+| **AttributeSet** | Specific attribute set to report on. If omitted, discovers and reports all. |
+| **SendEmail**   | Send report by email.                                                        |
+| **Recipient**   | Email recipient(s).                                                          |
+| **From**        | From address.                                                                |
+| **ExportPath**  | Output file path.                                                            |
+| **DebugMode**   | Enable debug output.                                                         |
+
+Connect first with **Connect-RKGraph**; this cmdlet uses the existing connection (no auth parameters).
+
+
+**Examples:**
+- `Get-CustomSecurityAttributesReport` — auto-discover all attribute sets
+- `Get-CustomSecurityAttributesReport -AttributeSet "ComplianceData"` — specific set only
+- `Get-CustomSecurityAttributesReport -SendEmail -Recipient "admin@contoso.com"` — generate and email
+
+---
+
 For full parameter sets and examples, run `Get-Help <CmdletName> -Full` in PowerShell.

docs/PERMISSIONS.md

@@ -12,6 +12,7 @@ Use these when registering an app in Azure AD / Entra ID or when calling `Connec
 |------------|---------|
 | **AuditLog.Read.All** | Get-EntraAdminRolesReport, Get-M365LicenseAssignmentReport |
 | **CustomSecAttributeAssignment.Read.All** | Get-CustomSecurityAttributesReport |
+| **CustomSecAttributeDefinition.Read.All** | Get-CustomSecurityAttributesReport |
 | **CloudLicensing.Read** | Get-M365LicenseAssignmentReport |
 | **CloudPC.Read.All** | Get-IntuneEnrollmentFlowsReport, Get-IntuneAnomaliesReport |
 | **Device.Read.All** | Get-IntuneEnrollmentFlowsReport |
@@ -57,6 +58,7 @@ Default `-RequiredScopes` is the **union** of all scopes below so one connection
 - CloudLicensing.Read  
 - CloudPC.Read.All
 - CustomSecAttributeAssignment.Read.All
+- CustomSecAttributeDefinition.Read.All
 
 ---
 
@@ -115,6 +117,7 @@ Default `-RequiredScopes` is the **union** of all scopes below so one connection
 ### Get-CustomSecurityAttributesReport
 
 - CustomSecAttributeAssignment.Read.All
+- CustomSecAttributeDefinition.Read.All
 - User.Read.All
 - Organization.Read.All
 - Mail.Send

module/README.md

@@ -1,6 +1,6 @@
 # RKSolutions PowerShell Script Module
 
-This is the script implementation of the RKSolutions module. It provides cmdlets to connect to Microsoft Graph and generate reports for Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, and M365 License Assignment.
+This is the script implementation of the RKSolutions module. It provides cmdlets to connect to Microsoft Graph and generate reports for Intune Enrollment Flows, Intune Anomalies, Entra Admin Roles, M365 License Assignment, and Custom Security Attributes.
 
 > **Requires PowerShell 7.0 or higher.** Windows PowerShell 5.1 is not supported.
 
@@ -17,7 +17,8 @@ module/
 │   ├── Get-IntuneEnrollmentFlowsReport.ps1
 │   ├── Get-IntuneAnomaliesReport.ps1
 │   ├── Get-EntraAdminRolesReport.ps1
-│   └── Get-M365LicenseAssignmentReport.ps1
+│   ├── Get-M365LicenseAssignmentReport.ps1
+│   └── Get-CustomSecurityAttributesReport.ps1
 └── Private/                   # Helpers (not exported; used internally by Public cmdlets)
     ├── Connect-ToMgGraph.ps1
     ├── Invoke-RKSolutionsWithConnection.ps1
@@ -26,10 +27,12 @@ module/
     ├── ConvertTo-DateString.ps1
     ├── Install-Requirements.ps1
     ├── Export-Results.ps1
+    ├── Get-RKSolutionsReportTemplate.ps1
     ├── IntuneEnrollmentFlows.ps1
     ├── IntuneAnomalies.ps1
     ├── EntraAdminRoles.ps1
-    └── M365License.ps1
+    ├── M365License.ps1
+    └── CustomSecurityAttributes.ps1
 ```
 
 ## Loading the script module