[royklo]

What's New

inforcer now has a versioned API (v1) with API clients that log in with a client ID and secret. 1.0.0 supports both logins: an API key keeps using the legacy beta API, and client credentials use v1. Every cmdlet works with either, and v1 responses are mapped to the module's usual property names, so most scripts run unchanged.

Highlights

• Connect-Inforcer -ClientId <id> -ClientSecret <secret> -Region uk, with automatic token renewal and 429 retries that honour Retry-After.
• -TenantId takes a Microsoft tenant ID (GUID) or a tenant name with both logins; numeric IDs keep working with an API key.
• Invoke-InforcerAssessment shows inforcer's own compliance score with client credentials. Compare-InforcerEnvironments can compare across logins, and it collects both tenants at the same time.
• v1 returns Intune policies (inforcer fixed ENG-6967, verified live: v1 = beta, 244 policies). Policy types inforcer could not read are named in a warning (failedPolicyTypes).

Fixes that API-key users get too

• Piping several tenants now handles every tenant. Before, only the last one was processed.
• Get-InforcerAlignmentDetails -Tag with a tag no tenant has returns nothing and warns; it used to return every row.
• The settings catalog updates again, and Get-InforcerSupportedEventType returns the live list.
• Correct Microsoft Learn names for 11 Conditional Access apps. The export fills "Profile type" again.
• Bulk report download through Save-InforcerReportOutput works.
• Security:
  • Downloads never overwrite files.
  • Exports neutralise formulas, and HTML reports escape names.
  • Credentials never follow a redirect.
  • The API key no longer ends up in $Error.

The full list and the migration steps are in CHANGELOG.md under 1.0.0.

Merge order

1. feat!: OAuth client credentials and the v1 API (1.0.0) #48 (module 1.0.0)
2. royklo/Powershell-Module-Automation#2
3. royklo/inforcerCommunity-mcp-source#29 (publishes to npm on merge)

Verification

• Pester: 848 passed of 852; 1 failure that also fails on main (SettingsCatalog integration test against the live catalog data, unrelated), 3 skipped. CI green.
• Live matrix: every cmdlet and option was run with an API key and with client credentials on the same tenants (109 cases) and compared output by output. That includes one real assessment and report run per variant. It was rerun after the review fixes. Rerun on 2026-11-08 after Intune was fixed: every case behaves the same on both logins; the only failure is Export -Tag, on both, because no policy in the test tenant carries a tag.
• API-key output was compared with 0.8.0 on the same account; the only differences are the fixes listed in the changelog.
• Reviews: consistency contract, security, performance, docs accuracy, static-to-dynamic, and API feedback. All high and medium findings are fixed.
• 2026-11-05: inforcer's v1 fixes (ENG-6987 to 6992) verified live and taken in: the full v1 tenant list (no per-tenant calls), the assessment score, one policy type name. Red/blue/green review of that change; every new behaviour survives mutation testing.

Full Changelog: v0.8.0...feature/oauth-auth

• 2026-11-08 final pass: red/blue/green over the whole branch. Fixed: no token or key in -Debug output or in a non-JSON error; failed requests are never shown as an empty or complete result (Get-InforcerUser -UserId, -BaselineId, user/group/audit JSON); an empty API answer is a clear error; same-named tenants in the assessment matrix; Markdown escaping of baseline/product/category names. Each fix has a test that fails without it. Live matrix rerun on both logins after the fixes: no status changes, no leaks.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unresolved security and correctness issues can expose client secrets in error records, trigger account-wide assessments from empty pipelines, and select groups from incomplete search results.

6 open issues

• Clear failed token request content containing the client secret · New
• Propagate paged search errors before resolving a group · New
• Validate every catalog entry before replacing the cache · New
• Check for repeated page tokens before emitting items · New
• Retry v1 report metadata requests on HTTP 429 · New
• Return early when the tenant pipeline has no input · New

What changed in this PR

Introduces the 1.0.0 dual-login model: OAuth client credentials use the v1 API, while API keys retain legacy beta access. Shared helpers normalize responses and authentication so existing cmdlets can support both APIs.

Changes:

• Adds v1 authentication, response mapping, tenant resolution, and shared pagination.
• Improves multi-tenant pipelines, report downloads, and parallel environment comparisons.
• Hardens credential handling and exports, refreshes settings-catalog handling, and documents migration.

File	Description
Tests/​GraphResolution.Tests.ps1	Replaces named-location fixture GUIDs.
Tests/​DocModel.Tests.ps1	Standardizes GUID comparison fixtures.
Tests/​Consistency.Tests.ps1	Updates authentication, pipeline, and download assertions.
module/​Public/​Test-InforcerConnection.ps1	Uses shared authenticated requests for connection checks.
module/​Public/​Save-InforcerReportOutput.ps1	Supports both APIs and safe filename overrides.
module/​Public/​Invoke-InforcerAssessment.ps1	Collects piped tenants and protects CSV values.
module/​Public/​Get-InforcerUser.ps1	Adds shared pagination and tenant-labelled pipeline output.
module/​Public/​Get-InforcerTenantPolicies.ps1	Supports v1 policies and warns about missing Intune data.
module/​Public/​Get-InforcerTenant.ps1	Adds v1 tenant details and session-cached lookups.
module/​Public/​Get-InforcerSupportedEventType.ps1	Corrects live event-type parsing.
module/​Public/​Get-InforcerSecureScore.ps1	Supports both APIs and combined pipeline JSON.
module/​Public/​Get-InforcerRole.ps1	Adds v1 mapping and tenant-labelled results.
module/​Public/​Get-InforcerReportType.ps1	Uses version-neutral report catalog requests.
module/​Public/​Get-InforcerReportRun.ps1	Maps v1 report runs to existing property names.
module/​Public/​Get-InforcerGroup.ps1	Adds shared pagination and separate v1 member retrieval.
module/​Public/​Get-InforcerBaseline.ps1	Fetches once and labels results for piped tenants.
module/​Public/​Get-InforcerAuditEvent.ps1	Consolidates searches through shared pagination.
module/​Public/​Get-InforcerAssessment.ps1	Uses version-neutral assessment requests.
module/​Public/​Disconnect-Inforcer.ps1	Recognizes either login type when disconnecting.
module/​Public/​Compare-InforcerEnvironments.ps1	Resolves baseline owners per session and propagates notes.
module/​Private/​Test-InforcerSession.ps1	Validates API-key or client-credential sessions.
module/​Private/​Test-InforcerReportRunTerminal.ps1	Supports v1 polling, token renewal, and output run IDs.
module/​Private/​Select-InforcerBaselinePolicies.ps1	Supports v1 tenant and policy identifiers.
module/​Private/​Resolve-InforcerTenantId.ps1	Resolves identifiers according to the active API.
module/​Private/​Resolve-InforcerReportTypeSchema.ps1	Uses mapped catalog requests and broader credential redaction.
module/​Private/​Resolve-InforcerReportOutputFileName.ps1	Prevents downloaded filenames from becoming hidden dotfiles.
module/​Private/​Resolve-InforcerGroupId.ps1	Searches all group pages during name resolution.
module/​Private/​Resolve-InforcerBaselineId.ps1	Uses version-neutral baseline lookup.
module/​Private/​Resolve-InforcerAssessmentId.ps1	Uses version-neutral assessment lookup.
module/​Private/​Protect-InforcerApiKeyInText.ps1	Extends redaction to secrets and bearer tokens.
module/​Private/​Invoke-InforcerRawDownload.ps1	Adds dual authentication and non-overwriting downloads.
module/​Private/​Invoke-InforcerPagedRequest.ps1	Centralizes pagination for both APIs.
module/​Private/​Invoke-InforcerGraphRequest.ps1	Refines retries and permission warnings.
module/​Private/​Invoke-InforcerAssessmentRun.ps1	Adds v1 retries and redirect-safe background requests.
module/​Private/​Get-InforcerTenantList.ps1	Adds a session-specific tenant cache.
module/​Private/​Get-InforcerSettingsCatalogPath.ps1	Fixes refresh handling and validates downloaded catalogs.
module/​Private/​Get-InforcerPolicyTypeName.ps1	Supplies fallback profile-type names.
module/​Private/​Get-InforcerDocData.ps1	Collects dual-API data and records coverage gaps.
module/​Private/​Get-InforcerComparisonData.ps1	Collects destination data concurrently with the source.
module/​Private/​Get-InforcerBaseUrl.ps1	Centralizes versioned URLs and endpoint renames.
module/​Private/​Get-InforcerBaselineList.ps1	Adds a session-specific baseline cache.
module/​Private/​Get-InforcerAuthHeader.ps1	Centralizes authentication and OAuth token renewal.
module/​Private/​Export-InforcerDocExcel.ps1	Neutralizes formulas and adds report notes.
module/​Private/​ConvertTo-InforcerMarkdown.ps1	Encodes HTML-sensitive text and includes notes.
module/​Private/​ConvertTo-InforcerHtml.ps1	Safely highlights search text and displays notes.
module/​Private/​ConvertTo-InforcerDocModel.ps1	Improves policy labels, profile types, and tenant fallbacks.
module/​Private/​ConvertTo-InforcerComparisonHtml.ps1	Safely constructs filters and displays coverage notes.
module/​Private/​ConvertTo-InforcerAssessmentMatrixHtml.ps1	Hardens embedded data and tenant controls.
module/​Private/​ConvertTo-InforcerAssessmentHtml.ps1	Escapes status attribute values.
module/​Private/​ConvertFrom-InforcerV1Response.ps1	Maps v1 objects to canonical property names.
module/​Private/​Connect-InforcerGraph.ps1	Expands default Graph read scopes.
module/​InforcerCommunity.psm1	Warns when unloading either authenticated session type.
module/​InforcerCommunity.psd1	Sets version 1.0.0 and updates release notes.
module/​InforcerCommunity.Format.ps1xml	Adapts displayed fields to API-specific properties.
CONTRIBUTING.md	Documents dual-API implementation and testing conventions.
CHANGELOG.md	Records release changes, limitations, and migration steps.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because the published review omits relevant concerns about Graph scope authorization and token-refresh behavior during retries.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to weigh moderate-severity risks in missing-policy detection, OAuth retry handling, and Graph scope-tag permissions.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because throttled retries can repeatedly refresh access tokens, while duplicate tenant-policy matches can suppress warnings about missing baseline policies.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to weigh omitted moderate findings involving repeated token refreshes, failed requests appearing successful but empty, and missed baseline policies.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because unpublished findings identify potential credential exposure in error handling, alongside policy-matching and Graph-permission issues.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The checkbox handler and visibility filtering still use tenant names instead of IDs, so unchecking one tenant can hide both columns when two tenants share a friendly name.

1 open issue

• Use tenant IDs to toggle visibility independently · New

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed to weigh unpublished moderate findings affecting aggregate output after failures, baseline completeness checks, and OAuth token refreshes during retries.

No open issues 🎉

1 resolved since last review

• Use tenant IDs to toggle visibility independently

_{Review effort: Balanced}