[royklo]

What's New

inforcer now has a versioned API (v1) with API clients that log in with a client ID and secret. 1.0.0 supports both logins: an API key keeps using the legacy beta API, and client credentials use v1. Every cmdlet works with either, and v1 responses are mapped to the module's usual property names, so most scripts run unchanged.

Highlights

• Connect-Inforcer -ClientId <id> -ClientSecret <secret> -Region uk, with automatic token renewal and 429 retries that honour Retry-After.
• -TenantId takes a Microsoft tenant ID (GUID) or a tenant name with both logins; numeric IDs keep working with an API key.
• Invoke-InforcerAssessment shows inforcer's own compliance score with client credentials. Compare-InforcerEnvironments can compare across logins, and it collects both tenants at the same time.
• v1 returns Intune policies (inforcer fixed ENG-6967, verified live: v1 = beta, 244 policies). Policy types inforcer could not read are named in a warning (failedPolicyTypes).

Fixes that API-key users get too

• Piping several tenants now handles every tenant. Before, only the last one was processed.
• Get-InforcerAlignmentDetails -Tag with a tag no tenant has returns nothing and warns; it used to return every row.
• The settings catalog updates again, and Get-InforcerSupportedEventType returns the live list.
• Correct Microsoft Learn names for 11 Conditional Access apps. The export fills "Profile type" again.
• Bulk report download through Save-InforcerReportOutput works.
• Security:
  • Downloads never overwrite files.
  • Exports neutralise formulas, and HTML reports escape names.
  • Credentials never follow a redirect.
  • The API key no longer ends up in $Error.

The full list and the migration steps are in CHANGELOG.md under 1.0.0.

Verification

• Pester: 828 passed; 1 failure that also fails on main (SettingsCatalog integration test against the live catalog data, unrelated).
• Live matrix: every cmdlet and option was run with an API key and with client credentials on the same tenants (109 cases) and compared output by output. That includes one real assessment and report run per variant. It was rerun after the review fixes. (That run predates inforcer's Intune fix; Export -Tag on v1 failed then because the tag sits on an Intune policy.)
• API-key output was compared with 0.8.0 on the same account; the only differences are the fixes listed in the changelog.
• Reviews: consistency contract, security, performance, docs accuracy, static-to-dynamic, and API feedback. All high and medium findings are fixed.
• 2026-11-05: inforcer's v1 fixes (ENG-6987 to 6992) verified live and taken in: the full v1 tenant list (no per-tenant calls), the assessment score, one policy type name. Red/blue/green review of that change; every new behaviour survives mutation testing.

Full Changelog: v0.8.0...feature/oauth-auth

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unresolved security and correctness issues can expose client secrets in error records, trigger account-wide assessments from empty pipelines, and select groups from incomplete search results.

6 open issues

• Clear failed token request content containing the client secret · New
• Propagate paged search errors before resolving a group · New
• Validate every catalog entry before replacing the cache · New
• Check for repeated page tokens before emitting items · New
• Retry v1 report metadata requests on HTTP 429 · New
• Return early when the tenant pipeline has no input · New

What changed in this PR

Introduces the 1.0.0 dual-login model: OAuth client credentials use the v1 API, while API keys retain legacy beta access. Shared helpers normalize responses and authentication so existing cmdlets can support both APIs.

Changes:

• Adds v1 authentication, response mapping, tenant resolution, and shared pagination.
• Improves multi-tenant pipelines, report downloads, and parallel environment comparisons.
• Hardens credential handling and exports, refreshes settings-catalog handling, and documents migration.

File	Description
Tests/​GraphResolution.Tests.ps1	Replaces named-location fixture GUIDs.
Tests/​DocModel.Tests.ps1	Standardizes GUID comparison fixtures.
Tests/​Consistency.Tests.ps1	Updates authentication, pipeline, and download assertions.
module/​Public/​Test-InforcerConnection.ps1	Uses shared authenticated requests for connection checks.
module/​Public/​Save-InforcerReportOutput.ps1	Supports both APIs and safe filename overrides.
module/​Public/​Invoke-InforcerAssessment.ps1	Collects piped tenants and protects CSV values.
module/​Public/​Get-InforcerUser.ps1	Adds shared pagination and tenant-labelled pipeline output.
module/​Public/​Get-InforcerTenantPolicies.ps1	Supports v1 policies and warns about missing Intune data.
module/​Public/​Get-InforcerTenant.ps1	Adds v1 tenant details and session-cached lookups.
module/​Public/​Get-InforcerSupportedEventType.ps1	Corrects live event-type parsing.
module/​Public/​Get-InforcerSecureScore.ps1	Supports both APIs and combined pipeline JSON.
module/​Public/​Get-InforcerRole.ps1	Adds v1 mapping and tenant-labelled results.
module/​Public/​Get-InforcerReportType.ps1	Uses version-neutral report catalog requests.
module/​Public/​Get-InforcerReportRun.ps1	Maps v1 report runs to existing property names.
module/​Public/​Get-InforcerGroup.ps1	Adds shared pagination and separate v1 member retrieval.
module/​Public/​Get-InforcerBaseline.ps1	Fetches once and labels results for piped tenants.
module/​Public/​Get-InforcerAuditEvent.ps1	Consolidates searches through shared pagination.
module/​Public/​Get-InforcerAssessment.ps1	Uses version-neutral assessment requests.
module/​Public/​Disconnect-Inforcer.ps1	Recognizes either login type when disconnecting.
module/​Public/​Compare-InforcerEnvironments.ps1	Resolves baseline owners per session and propagates notes.
module/​Private/​Test-InforcerSession.ps1	Validates API-key or client-credential sessions.
module/​Private/​Test-InforcerReportRunTerminal.ps1	Supports v1 polling, token renewal, and output run IDs.
module/​Private/​Select-InforcerBaselinePolicies.ps1	Supports v1 tenant and policy identifiers.
module/​Private/​Resolve-InforcerTenantId.ps1	Resolves identifiers according to the active API.
module/​Private/​Resolve-InforcerReportTypeSchema.ps1	Uses mapped catalog requests and broader credential redaction.
module/​Private/​Resolve-InforcerReportOutputFileName.ps1	Prevents downloaded filenames from becoming hidden dotfiles.
module/​Private/​Resolve-InforcerGroupId.ps1	Searches all group pages during name resolution.
module/​Private/​Resolve-InforcerBaselineId.ps1	Uses version-neutral baseline lookup.
module/​Private/​Resolve-InforcerAssessmentId.ps1	Uses version-neutral assessment lookup.
module/​Private/​Protect-InforcerApiKeyInText.ps1	Extends redaction to secrets and bearer tokens.
module/​Private/​Invoke-InforcerRawDownload.ps1	Adds dual authentication and non-overwriting downloads.
module/​Private/​Invoke-InforcerPagedRequest.ps1	Centralizes pagination for both APIs.
module/​Private/​Invoke-InforcerGraphRequest.ps1	Refines retries and permission warnings.
module/​Private/​Invoke-InforcerAssessmentRun.ps1	Adds v1 retries and redirect-safe background requests.
module/​Private/​Get-InforcerTenantList.ps1	Adds a session-specific tenant cache.
module/​Private/​Get-InforcerSettingsCatalogPath.ps1	Fixes refresh handling and validates downloaded catalogs.
module/​Private/​Get-InforcerPolicyTypeName.ps1	Supplies fallback profile-type names.
module/​Private/​Get-InforcerDocData.ps1	Collects dual-API data and records coverage gaps.
module/​Private/​Get-InforcerComparisonData.ps1	Collects destination data concurrently with the source.
module/​Private/​Get-InforcerBaseUrl.ps1	Centralizes versioned URLs and endpoint renames.
module/​Private/​Get-InforcerBaselineList.ps1	Adds a session-specific baseline cache.
module/​Private/​Get-InforcerAuthHeader.ps1	Centralizes authentication and OAuth token renewal.
module/​Private/​Export-InforcerDocExcel.ps1	Neutralizes formulas and adds report notes.
module/​Private/​ConvertTo-InforcerMarkdown.ps1	Encodes HTML-sensitive text and includes notes.
module/​Private/​ConvertTo-InforcerHtml.ps1	Safely highlights search text and displays notes.
module/​Private/​ConvertTo-InforcerDocModel.ps1	Improves policy labels, profile types, and tenant fallbacks.
module/​Private/​ConvertTo-InforcerComparisonHtml.ps1	Safely constructs filters and displays coverage notes.
module/​Private/​ConvertTo-InforcerAssessmentMatrixHtml.ps1	Hardens embedded data and tenant controls.
module/​Private/​ConvertTo-InforcerAssessmentHtml.ps1	Escapes status attribute values.
module/​Private/​ConvertFrom-InforcerV1Response.ps1	Maps v1 objects to canonical property names.
module/​Private/​Connect-InforcerGraph.ps1	Expands default Graph read scopes.
module/​InforcerCommunity.psm1	Warns when unloading either authenticated session type.
module/​InforcerCommunity.psd1	Sets version 1.0.0 and updates release notes.
module/​InforcerCommunity.Format.ps1xml	Adapts displayed fields to API-specific properties.
CONTRIBUTING.md	Documents dual-API implementation and testing conventions.
CHANGELOG.md	Records release changes, limitations, and migration steps.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Unresolved correctness issues can duplicate paged records, hide incomplete-request failures, abort report polling on throttling, and violate documented v1 JSON-array contracts.

10 open issues

• Propagate paged search errors before resolving a group
• Clear failed token request content containing the client secret
• Propagate background collection errors before accepting results · New
• Count baseline entries and recognize successful ID matches · New
• Preserve v1 array output when filtering baselines · New
• Preserve v1 JSON arrays for empty and single-run results · New
• Return early when the tenant pipeline has no input
• Retry v1 report metadata requests on HTTP 429
• Check for repeated page tokens before emitting items
• Validate every catalog entry before replacing the cache

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Successful empty v1 tenant responses bypass JSON serialization, causing -OutputType JsonObject to return $null instead of [] and violating the documented list-array contract.

No open issues 🎉

1 previously missed issue

In code that hasn't changed since last review

Return an empty JSON array for successful v1 tenant lists

module/​Public/​Get-InforcerTenant.ps1:115

A successful v1 response with no visible tenants exits here before JSON serialization, so Get-InforcerTenant -OutputType JsonObject returns $null rather than []. This breaks the documented v1 list-array contract for clients whose tenant filters match nothing. Let successful empty v1 lists reach the JSON branch, while preserving beta behavior and returning nothing when the list request fails.

10 resolved since last review

• Propagate paged search errors before resolving a group
• Clear failed token request content containing the client secret
• Preserve v1 JSON arrays for empty and single-run results
• Preserve v1 array output when filtering baselines
• Count baseline entries and recognize successful ID matches
• Propagate background collection errors before accepting results
• Return early when the tenant pipeline has no input
• Retry v1 report metadata requests on HTTP 429
• Check for repeated page tokens before emitting items
• Validate every catalog entry before replacing the cache

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the published review omits relevant concerns about Graph scope authorization and token-refresh behavior during retries.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to weigh moderate-severity risks in missing-policy detection, OAuth retry handling, and Graph scope-tag permissions.

No open issues 🎉

_{Review effort: Balanced}