purview-v1.11.16-prerelease-20260916-06

Preview build of the PAX Purview Audit Log Processor.

Fixes multiple quoted GroupNames values containing spaces when launched with pwsh -File. The existing command-line invocation remains supported.

Based on prerelease 20260911a; newer v2.0.0 development changes are not included.

This is not a released version and has not completed full customer testing. Please read the prerelease branch README before running it, and use the current release for production reporting.

SHA256: 46D4B1EE6DD60C74076AC8C00D5FF50F0C95A9BA3672A00BC161CB715B7DA04C

purview-v1.11.16-prerelease-20260911a

Preview build of the PAX Purview Audit Log Processor.

This is not a released version and has not completed full customer testing. Please read the prerelease branch README before running it, and use the current release for production reporting.

SHA256: 99E87F4B6116D6EEA406314CB5EEE782865F4DB1107ACB5396B5CF81EE57655A

purview-v1.11.16-prerelease-20260910a

Preview build of the PAX Purview Audit Log Processor.

This is not a released version and has not completed full customer testing. Please read the prerelease branch README before running it, and use the current release for production reporting.

SHA256: 703294A115C94498FFCE2E603EDAAA50C4991F442BED61EB6FA55E98D5B1108B

purview-v1.11.16-prerelease-20260901a

Preview build of the PAX Purview Audit Log Processor.

This is not a released version and has not completed full customer testing. Please read the prerelease branch README before running it, and use the current release for production reporting.

SHA256: A20AEBBCC44F09584E93B943B1171F6F65B9C9BDFE74621F3103B4F836EEFD99

purview-v1.11.16-prerelease-20260826a

Preview build of the PAX Purview Audit Log Processor.

This is not a released version and has not completed full customer testing. Please read the prerelease branch README before running it, and use the current release for production reporting.

SHA256: 9AD81A9545FDA3A0CE5B92BCBAA3095961F3B79BBA01AA5FF7F772181E2ECA1A

purview-v1.11.16-prerelease-20260825a

Preview build of the PAX Purview Audit Log Processor.

This is not a released version and has not completed full customer testing. Please read the prerelease branch README before running it, and use the current release for production reporting.

SHA256: 17882ED51E11F6BF8611AA753FF55DB46E8F2E7C53495DAC8957B4A479392899

purview-v1.11.15

v1.11.15

Version 1.11.15 is both a feature release and a reliability and correctness release. It renames one dashboard selector value to ValueLens, adds hybrid directory enrichment with -UserInfoSupplement, introduces a distinct "completed with gaps" exit code for unattended runs, and delivers a broad set of correctness fixes that apply to ordinary runs, so existing workflows benefit without any change to how they are invoked.

-Dashboard ValueLens - Renamed Dashboard Selector

The customer-facing value for one dashboard selector is now ValueLens; select it with -Dashboard ValueLens. This is a name-only change - the data, output schema, append behavior, de-identification, and output files are unchanged - and existing checkpoints resume automatically as ValueLens with no action required. The former public value is no longer accepted for new commands.

Bring Your Own Directory - Hybrid Enrichment (-UserInfoSupplement)

The new -UserInfoSupplement switch enriches the live Microsoft Entra directory instead of replacing it. PAX fetches the Entra /users directory as usual, then appends the columns of a supplied CSV to each matching Entra row, joined on UserPrincipalName. Every Entra user is preserved; supplemental rows that match no Entra user are reported and excluded. UserPrincipalName is a join key only and is never copied into the output, so identity always comes from Entra. Supplemental columns are additive-only, and their names, order, and values are preserved unchanged. The supplemental input may be a local CSV, a SharePoint CSV URL, or a Microsoft Fabric / OneLake CSV URL. With -Deidentify, Entra-derived identity fields are de-identified as usual while supplemental values pass through unchanged, and a prominent notice is shown before processing.

New "Completed with Gaps" Exit Code (40)

For unattended and scheduled use, a run that finishes but leaves gaps - a partition that failed terminally, or a time window that reached the subdivision-depth safeguard - now returns process exit code 40, so automation can tell it apart from a clean success. The existing exit codes are unchanged and keep priority; 40 is the lowest-precedence signal. A full exit-code reference was added to the script's built-in help.

Partition-Failure and Subdivision Reliability

A partition that keeps failing the same way now stops instead of retrying indefinitely, and a defensive depth limit stops runaway time-window subdivision. Both situations are reported in the end-of-run summary with a -Resume hint.

SharePoint and Large-File Handling Corrections

SharePoint output no longer over-requests permissions or emits a false missing-permission warning. A large existing SharePoint append target downloads memory-safely, large single-file uploads use a corrected bounded-memory path, and an upload failure now preserves the local copy and is reflected in the run outcome.

Faster Interactions/Fact Append on Large Targets

Appending a run into an existing Interactions/Fact CSV now completes substantially faster on large targets, and the improvement grows with the size of the target. The result is unchanged in every respect - the merged output is byte-for-byte identical, the same fixed memory budget applies, temporary disk space is still used during the merge and removed afterward, and there is no row limit or truncation. If the faster path is unavailable on a given machine, the original path is used automatically, so results and compatibility are preserved.

Faster Fact Continuity Preparation for Append Rollups

Preparing continuity keys from an existing Fact file now uses a disk-backed accelerator for supported identifier forms, completing substantially faster while keeping memory bounded. Seed contents, first-occurrence behavior, identifier casing, and continuity results remain unchanged. If the existing file contains an unsupported key form, PAX automatically uses the established compatibility path with no action or configuration required. Temporary working files are removed when the step finishes, and a failure leaves the existing append target untouched.

Advisory Before Merging an Unusually Large Append Target

Before merging into an existing append target, PAX checks the size of the target without downloading it and prints a one-line advisory if it is larger than a set threshold (1 GB by default). It is advisory only - the run always continues and a legitimately large target is never blocked - and it is silently skipped if the size cannot be read. The threshold can be changed with the PAX_APPEND_WARN_BYTES environment variable (in bytes), which controls only the advisory and does not cap processing.

-UserIds / -GroupNames Filtering

User filtering now applies consistently on every directory-backed pass, first pass and any retry pass, so a run scoped only with -GroupNames no longer collects more broadly than intended. Runs that supply neither switch are unchanged.

Clearer Guidance for Restricted PowerShell Language Mode

A run started under a restricted PowerShell language mode now reports the condition clearly and explains what to change.

Looking Ahead - AI Solutions Intelligence Dashboard (AISID)

PAX is working toward support for the AI Solutions Intelligence Dashboard (AISID). AISID is still under development and is not available for customer use in this version: -Dashboard AISID, -OutputPathDefenderUsage, -AppendDefenderUsage, and -DisableAISIDDeltaCache report that AISID is under development and stop the run before any sign-in, collection, or publication. Availability is planned for a later PAX script version. No action is needed today.

---

Full release notes: PAX_Purview_Audit_Log_Processor_Release_Note_v1.11.x.md

Documentation: PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md

purview-v1.11.14

v1.11.14

Version 1.11.14 is a reliability release that fixes two remote-output delivery defects. Both fixes restore intended behavior — there are no new switches, no output-schema changes, and no change to how any run is invoked; runs that do not use the affected remote-output paths behave exactly as in v1.11.13. The first fix ensures the Microsoft Agent 365 catalog CSV is actually delivered to a SharePoint or Microsoft Fabric / OneLake destination (previously it could be generated but not uploaded). The second ensures a custom-named per-stream output file is delivered to its own per-stream destination rather than the primary output location.

Microsoft Agent 365 Catalog CSV Delivered to Remote Destinations

On a remote-output run (SharePoint or Microsoft Fabric / OneLake) that included the Microsoft Agent 365 catalog, the catalog CSV could be generated but not uploaded to the destination, even though the other artifacts (audit CSV, Entra Users, run log) uploaded normally. The catalog CSV is now registered with the end-of-run upload step in every remote-output mode, so it is delivered in the same final upload as every other artifact; a genuine upload failure now also preserves the local copy for retry. There are no new switches and no change to how the Agent 365 export is run.

Custom-Named Per-Stream Output Delivered to Its Own Destination

On a remote-output run that sent a per-stream output (for example the Agent 365 catalog or the Entra Users file) to a per-stream destination using a custom file name, the file could be delivered to the primary output location rather than the per-stream destination that was specified. Each file is now identified by the stream that produced it, so a custom-named per-stream file is delivered to its own destination; files with standard names resolve to exactly the same destination as before.

Looking Ahead

PAX is working toward support for the AI Solutions Intelligence Dashboard (AISID), a future capability that will enrich the Purview and Entra dataset with Microsoft Defender signals about how AI solutions are used across the organization. It is not available in this version: selecting -Dashboard AISID exits immediately with a notice and does nothing, and the related -OutputPathDefenderUsage / -AppendDefenderUsage options have no effect. Full AISID functionality is planned for an upcoming release. No action is needed today.

purview-v1.11.13

v1.11.13

Version 1.11.13 is a reliability release that fixes two field-reported defects. Both fixes restore intended behavior — there are no new switches, no output-schema changes, and no change to how any run is invoked; runs that do not use the affected paths behave exactly as in v1.11.12. The first fix restores Microsoft Agent 365 catalog enrichment under app-only authentication, which could previously produce an Agent 365 export with no rows. The second restores cross-run -AppendFile reconciliation of the rolled-up interactions file when the remote append target is named with a custom (non-standard) filename.

Microsoft Agent 365 Catalog Enrichment Restored (App-Only Runs)

Under app-only authentication, the Agent 365 catalog enrichment step could fail for every catalog entry, producing an export with no rows even when the catalog listed hundreds of packages. Enrichment now completes normally so catalog rows are written, with a defensive fallback that logs a clear warning and continues with blank date-created / created-by values rather than dropping rows if enrichment data is ever unavailable. There are no new switches and no change to how the Agent 365 export is run.

Cross-Run Append Restored for Custom-Named Remote Rollup Targets (-AppendFile)

When appending a rolled-up interactions run (-Rollup with -AppendFile) to a target on SharePoint or Microsoft Fabric / OneLake whose filename did not follow the standard rolled-up naming, the run could add zero new rows and mark every existing row as departed — even though fresh interactions were retrieved. The run now always processes its own fresh export (never the downloaded copy of the target) regardless of the target's filename, so the append reconciles correctly: overlapping rows de-duplicate, new rows are added, and existing rows are preserved. A note is now logged when a rollup append target uses a non-standard name. The existing append data-safety protections are unchanged.

purview-v1.11.12

v1.11.12

Version 1.11.12 fixes a cross-run -AppendFile reconciliation problem in the rolled-up interactions file, adds a supporting identity column to the AI-in-One (AIO) rolled-up interactions file, and improves the reliability of the Microsoft Agent 365 catalog export. Runs that do not append rolled-up interactions and do not use Agent 365 behave as in v1.11.11, with one additive exception: the AIO rolled-up interactions file now carries one extra identity column (described below). A one-time re-baseline applies to interaction append files created before v1.11.12.

Fan-Out-Safe Cross-Run Append & One-Time Re-Baseline (-AppendFile)

A single interaction (message) can produce several rolled-up rows — one per distinct combination of the analytical grain (for example, per accessed resource). v1.11.11 reconciled an appended rollup on the message identity alone, which treated all of a message's rows as one and could drop the extra rows when a later run re-emitted only some of them. v1.11.12 reconciles on the full grain together with the message identity, so every row is matched independently: overlapping rows de-duplicate, new rows are added, and existing-only rows are preserved — an exact union with nothing dropped or double-counted. To protect your data, PAX does not silently merge onto an append file that predates this change or that lacks any column the new reconciliation needs (for example an older AIO file created before the new identity column existed). Instead it leaves the old file untouched, writes this run's output to a new timestamped file, and prints re-baseline guidance. The practical effect is a one-time re-baseline — generate a fresh file once with v1.11.12 and append onto that from then on — with no data lost in the transition.

Stable User Identity on the AI-in-One Rolled-Up Interactions File

The AIO rolled-up interactions file now carries a stable, normalized user-identity column (User_Id_Normalized), matching the equivalent column the AI Business Value (AIBV) rollup already provides. It is additive — every existing column is unchanged — and it anchors the cross-run reconciliation above on a stable identity rather than a per-run surrogate. When -Deidentify is used, this column is anonymized with the same irreversible, format-preserving token as every other identity in the output, so it never exposes a raw user identity.

Microsoft Agent 365 Catalog — Reliability

The Microsoft Agent 365 catalog export is more resilient to Microsoft Graph throttling: catalog reads now retry automatically on rate-limit (HTTP 429) and transient server responses, honoring the service's Retry-After timing when provided. An internal variable-naming issue in the package-details path that could interfere with per-package processing is also corrected. There are no new switches and no change to how you run the Agent 365 export.