v1.11.15
Version 1.11.15 is both a feature release and a reliability and correctness release. It renames one dashboard selector value to ValueLens, adds hybrid directory enrichment with -UserInfoSupplement, introduces a distinct "completed with gaps" exit code for unattended runs, and delivers a broad set of correctness fixes that apply to ordinary runs, so existing workflows benefit without any change to how they are invoked.
-Dashboard ValueLens - Renamed Dashboard Selector
The customer-facing value for one dashboard selector is now ValueLens; select it with -Dashboard ValueLens. This is a name-only change - the data, output schema, append behavior, de-identification, and output files are unchanged - and existing checkpoints resume automatically as ValueLens with no action required. The former public value is no longer accepted for new commands.
Bring Your Own Directory - Hybrid Enrichment (-UserInfoSupplement)
The new -UserInfoSupplement switch enriches the live Microsoft Entra directory instead of replacing it. PAX fetches the Entra /users directory as usual, then appends the columns of a supplied CSV to each matching Entra row, joined on UserPrincipalName. Every Entra user is preserved; supplemental rows that match no Entra user are reported and excluded. UserPrincipalName is a join key only and is never copied into the output, so identity always comes from Entra. Supplemental columns are additive-only, and their names, order, and values are preserved unchanged. The supplemental input may be a local CSV, a SharePoint CSV URL, or a Microsoft Fabric / OneLake CSV URL. With -Deidentify, Entra-derived identity fields are de-identified as usual while supplemental values pass through unchanged, and a prominent notice is shown before processing.
New "Completed with Gaps" Exit Code (40)
For unattended and scheduled use, a run that finishes but leaves gaps - a partition that failed terminally, or a time window that reached the subdivision-depth safeguard - now returns process exit code 40, so automation can tell it apart from a clean success. The existing exit codes are unchanged and keep priority; 40 is the lowest-precedence signal. A full exit-code reference was added to the script's built-in help.
Partition-Failure and Subdivision Reliability
A partition that keeps failing the same way now stops instead of retrying indefinitely, and a defensive depth limit stops runaway time-window subdivision. Both situations are reported in the end-of-run summary with a -Resume hint.
SharePoint and Large-File Handling Corrections
SharePoint output no longer over-requests permissions or emits a false missing-permission warning. A large existing SharePoint append target downloads memory-safely, large single-file uploads use a corrected bounded-memory path, and an upload failure now preserves the local copy and is reflected in the run outcome.
Faster Interactions/Fact Append on Large Targets
Appending a run into an existing Interactions/Fact CSV now completes substantially faster on large targets, and the improvement grows with the size of the target. The result is unchanged in every respect - the merged output is byte-for-byte identical, the same fixed memory budget applies, temporary disk space is still used during the merge and removed afterward, and there is no row limit or truncation. If the faster path is unavailable on a given machine, the original path is used automatically, so results and compatibility are preserved.
Faster Fact Continuity Preparation for Append Rollups
Preparing continuity keys from an existing Fact file now uses a disk-backed accelerator for supported identifier forms, completing substantially faster while keeping memory bounded. Seed contents, first-occurrence behavior, identifier casing, and continuity results remain unchanged. If the existing file contains an unsupported key form, PAX automatically uses the established compatibility path with no action or configuration required. Temporary working files are removed when the step finishes, and a failure leaves the existing append target untouched.
Advisory Before Merging an Unusually Large Append Target
Before merging into an existing append target, PAX checks the size of the target without downloading it and prints a one-line advisory if it is larger than a set threshold (1 GB by default). It is advisory only - the run always continues and a legitimately large target is never blocked - and it is silently skipped if the size cannot be read. The threshold can be changed with the PAX_APPEND_WARN_BYTES environment variable (in bytes), which controls only the advisory and does not cap processing.
-UserIds / -GroupNames Filtering
User filtering now applies consistently on every directory-backed pass, first pass and any retry pass, so a run scoped only with -GroupNames no longer collects more broadly than intended. Runs that supply neither switch are unchanged.
Clearer Guidance for Restricted PowerShell Language Mode
A run started under a restricted PowerShell language mode now reports the condition clearly and explains what to change.
Looking Ahead - AI Solutions Intelligence Dashboard (AISID)
PAX is working toward support for the AI Solutions Intelligence Dashboard (AISID). AISID is still under development and is not available for customer use in this version: -Dashboard AISID, -OutputPathDefenderUsage, -AppendDefenderUsage, and -DisableAISIDDeltaCache report that AISID is under development and stop the run before any sign-in, collection, or publication. Availability is planned for a later PAX script version. No action is needed today.
Full release notes: PAX_Purview_Audit_Log_Processor_Release_Note_v1.11.x.md
Documentation: PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md