365TUNE

Author(s)

• Metawise Consulting LLC

Tags

Azure Microsoft365 M365 MSP Licensing Security Compliance CIS Entra GDAP ExchangeOnline 365TUNE

Functions

Invoke-365TUNEConnectAll Invoke-365TUNERevokeAll Invoke-365TuneConnectAzure Invoke-365TuneRevokeAzure Invoke-365TuneConnectExchange Invoke-365TuneRevokeExchange Invoke-365TuneConnectTeams Invoke-365TuneRevokeTeams Invoke-365TuneTestAzure Invoke-365TuneTestExchange Invoke-365TuneTestTeams Invoke-365TUNETestAll

Dependencies

This module has no dependencies.

Release Notes

v2.3.13 (bug fix release)
- Fixed Cloud Shell CLI bridge token propagation (all 7 affected functions): when authentication
 uses the Azure CLI bridge (az account get-access-token + Connect-AzAccount -AccessToken), the
 resulting static-token context cannot issue tokens for other resources via Get-AzAccessToken
 (no refresh token). Every Get-AzAccessToken call is now wrapped in try/catch; if it throws,
 the catch re-fetches the token directly from az account get-access-token. This covers both
 standalone function calls and calls from orchestrators via -SkipAuth.

v2.3.12 (bug fix release)
- Fixed Cloud Shell MSI handling (all 12 functions): when Get-AzContext -ListAvailable
 returns no user context, the module now bridges from Azure CLI which is always
 authenticated as the portal user in Cloud Shell. Uses az account get-access-token to
 obtain ARM and Graph tokens, then calls Connect-AzAccount -AccessToken to establish the
 user context in Az PowerShell without any interactive prompt or device code.

v2.3.11 (bug fix release)
- Fixed Cloud Shell MSI handling (all 12 functions): replaced Connect-AzAccount with
 Get-AzContext -ListAvailable + Set-AzContext. When Cloud Shell is opened from the Azure
 Portal, it injects the user's context alongside MSI but MSI may be set as active. The
 fix finds the first non-MSI context in the list and switches to it without any login
 prompt. Falls back to Connect-AzAccount only if no user context is present at all.

v2.3.10 (bug fix release)
- Fixed Cloud Shell MSI handling (all 12 functions): when Cloud Shell starts with MSI
 context, functions now call Connect-AzAccount WITHOUT calling Disconnect-AzAccount first.
 This keeps MSI as a fallback while attempting browser-based (portal session) login.
 The v2.3.8 approach called Disconnect first, which stripped the MSI fallback and caused
 Connect-AzAccount to fail silently, leaving no context at all.
- Fixed Remove-365TuneElevation MSI account quirk: elevation cleanup used SignInName to
 find the User Access Administrator assignment, but MSI/SP accounts have no SignInName so
 the assignment was never found and left in place. Lookup now uses a REST API call filtered
 by principalId (OID from the JWT), which works for both user and MSI/SP accounts. The
 Az cmdlet is retained as a fallback.

v2.3.8 (bug fix release)
- Fixed Cloud Shell MSI fallback (all 12 functions): when Cloud Shell is opened outside
 the Azure Portal the pre-loaded context is MSI rather than a user account. All functions
 now detect this and call Connect-AzAccount (browser-based, no device code) to obtain a
 real user context before proceeding instead of throwing immediately.

v2.3.7 (bug fix release)
- Fixed Cloud Shell MSI authentication (all 12 functions): Connect-AzAccount in Cloud Shell
 was replacing the pre-loaded user context with the Cloud Shell Managed Service Identity.
 All functions now skip Connect-AzAccount in Cloud Shell and use the existing user context.
 Added MSI guard: throws a clear error if Cloud Shell context is MSI instead of a user.

v2.3.6 (bug fix release)
- Fixed UnsupportedFilter error in TestAzure, ConnectAzure, and RevokeAzure: root-scope
 role assignment queries now include principalId filter required by the Azure ARM API.
 Unfiltered queries at '/' scope are rejected by the API with UnsupportedFilter.

v2.3.5 (bug fix release)
- Fixed Cloud Shell authentication: all functions now authenticate as the signed-in user
 instead of the VM Managed Identity (MSI). MSI has no Graph API or Exchange Admin
 permissions, causing all Cloud Shell runs to fail silently or throw.
- Fixed 5 misplaced backtick line-continuations in ConnectExchange, ConnectTeams,
 RevokeTeams that broke command parsing and caused ParameterBindingExceptions.
- Fixed -TimeoutSec and -ErrorAction Stop being bound to Where-Object instead of
 Invoke-RestMethod in ConnectAzure and RevokeAzure (6 occurrences).
- Fixed -ErrorAction Stop applied to Out-Null instead of Invoke-RestMethod in
 ConnectExchange and ConnectTeams, causing silent swallowing of HTTP errors.
- Fixed RevokeAzure: REST queries between elevation and try/finally block were
 unprotected - if they threw, User Access Administrator elevation was never removed.
 All post-elevation code is now inside a single try/finally block.
- Updated ConnectExchange and RevokeExchange .DESCRIPTION: now supported in Cloud Shell.