Microsoft-Secure-Score-Assessment-Toolkit

Author(s)

• Mohammed Siddiqui

Tags

Microsoft365 M365 SecureScore Security Compliance Audit Assessment Graph GraphAPI SecurityCompliance SecurityAssessment SecurityPosture CyberSecurity GRC RiskManagement SecurityControls EntraID AzureAD Defender Purview Intune

Functions

Connect-MicrosoftSecureScore Disconnect-MicrosoftSecureScore Invoke-MicrosoftSecureScore Get-MicrosoftSecureScoreInfo

PSEditions

Desktop Core

Dependencies

• • Microsoft.Graph.Authentication (>= 2.28.0)
  • Microsoft.Graph.Security (>= 2.28.0)

Release Notes

v2.3.0 Security Hardening, Performance Fixes, and Portal URL Modernization

BUG FIXES
- Fixed composable filter system: status + risk + search filters now work together
- Added "All" reset button to risk filter group
- Fixed progress bar counting excluded controls incorrectly
- Fixed Get-OrganizationInfo not handling array return from API
- Fixed 2 GitHub controls silently dropped due to non-HTTP ActionUrl validation
- Non-standard ActionUrls now fall back to portal keyword match instead of rejecting the control

PERFORMANCE
- Replaced string concatenation with StringBuilder in HTML report generation
- Replaced O(n*m) nested loop with O(1) hashtable lookup for URL mappings
- Async Google Fonts loading prevents render-blocking in offline environments

SECURITY
- Removed dangerous auto-install with -Force -AllowClobber (supply chain risk)
- Prevented sovereign cloud URLs from being rewritten to commercial domains
- Replaced empty catch block with diagnostic logging

PORTAL URL MODERNIZATION
- Migrated all compliance.microsoft.com URLs to purview.microsoft.com (retired late 2024)
- Added URL rewrite rule to auto-correct API-returned compliance.microsoft.com URLs
- Added 6 new control-to-portal URL mappings (71 total), eliminating all docs-only URLs
- Added "Purview" keyword to compliance fallback rule

MODULE QUALITY
- Declared RequiredModules in manifest (Microsoft.Graph SDK >= 2.28.0)
- Cross-platform paths via Join-Path throughout module loader
- Clean up all module state in Disconnect finally block
- Get-MicrosoftSecureScoreInfo returns PSCustomObject for programmatic access
- Force array context with @() on API collection returns
- Added -ErrorAction to all critical cmdlet calls

Full changelog at https://github.com/mohammedsiddiqui6872/Microsoft-Secure-Score-Assessment-Toolkit/blob/main/CHANGELOG.md