microsoft/PAX purview-v1.11.2

purview-v1.11.2

Repository: microsoft/PAX

Tag: purview-v1.11.2

Published: 2026-05-18T03:34:49Z

Prerelease: no

Release notes:

Release Notes: v1.11.x

Release Information

• Latest Version: 1.11.2
• Latest Release Date: 2026-05-17
• Released By: Microsoft Copilot Growth ROI Advisory Team (copilot-roi-advisory-team-gh@microsoft.com)

---

Script Download & Support

Download the script below. For questions or issues, refer to the documentation.

• PAX Purview Audit Log Processor Script v1.11.2: PAX_Purview_Audit_Log_Processor_v1.11.2.ps1
• Documentation v1.11.x (Markdown): PAX_Purview_Audit_Log_Processor_Documentation_v1.11.x.md

---

Overview

v1.11.2

Version 1.11.2 redesigns the output destination model around symmetric per-data-type switch pairs, extends cross-run append/merge to every data stream PAX produces, and introduces Microsoft Fabric Lakehouse Delta-table output. Existing v1.11.1 behavior is preserved when none of the new switches are used.

Unified Per-Data-Type Destination Model

A symmetric -OutputPath* / -Append* switch pair is provided for each output stream — Purview audit (-OutputPath / -AppendFile), EntraUsers / MAC licensing (-OutputPathUserInfo / -AppendUserInfo), Microsoft Agent 365 catalog (-OutputPathAgent365Info / -AppendAgent365Info), and run log (-OutputPathLog). Storage tier is inferred from each path's form: drive-rooted absolute paths resolve to Local, https://...sharepoint.com/... URLs resolve to SharePoint, and https://...onelake.dfs.fabric.microsoft.com/...Lakehouse/... URLs resolve to Fabric. UNC paths are rejected on every destination switch, and every destination supplied to a single run must resolve to the same storage tier. The legacy -OutputPathSP and -OutputPathFabric switches are removed — express remote destinations via any -OutputPath* value whose form is a SharePoint or OneLake URL.

Per-Dimension Append and Cross-Run Merge for All Outputs

-AppendFile now works across all rollup modes (-Rollup, -RollupPlusRaw) on all three storage tiers. Two new switches — -AppendUserInfo and -AppendAgent365Info — extend the same union-merge contract to the EntraUsers and Agent 365 catalog outputs respectively. Every append-mode run emits a standard Retained / New / Departed / Union merge tally for each merged stream; the merge is union-only — rows are never dropped from the target. Departed rows are kept in the merged file with In_Latest_Append=FALSE. Three provenance columns (Date_Added, Latest_Append_Date, In_Latest_Append) are appended to any merged file so analysts can see when each row first appeared and whether it was present in the most recent run. The CopilotInteraction rollup Fact CSV additionally gains two raw identity columns (Message_Id_Raw, ThreadId_Raw) so per-run integer surrogate keys remain stable across appends.

Microsoft Fabric Lakehouse Delta-Table Output

When any -OutputPath* value resolves to a Fabric OneLake URL, customer-visible outputs are written as Delta tables under the Lakehouse Tables/ namespace — queryable directly from the Fabric SQL endpoint and consumable by Direct Lake Power BI semantic models. Table names are evergreen (CSV basename with the _YYYYMMDD_HHMMSS run-timestamp stripped), so the same table is overwritten run after run while CSV filenames continue to carry the timestamp suffix. Schema evolution is automatic via schema_mode='merge' so dynamic -ExplodeDeep columns are absorbed as new nullable columns on subsequent appends; mode mismatches across runs into the same target table are rejected at pre-flight. The deltalake>=0.15 Python package is auto-installed on first use, mirroring the existing orjson install pattern. Resume artifacts are mirrored to durable OneLake storage at /Files/.pax_resume// so resume survives ephemeral container restarts.

Operational Hardening for Noninteractive Hosts

A new noninteractive-host detector and a bootstrap-log infrastructure layer harden PAX for execution inside Azure Container Apps Jobs, Windows services, scheduled tasks, and CI runners. The bootstrap log opens at the first executable line of the script body so pre-flight failures leave a readable log file behind; at log finalization the bootstrap content migrates into the final resolved log path.

Fabric / ACA Deployment Helpers (fabric_resources/)

A new top-level fabric_resources/ folder ships two supported Fabric on-ramps and the shared prereqs script: a top-level overview / path decision guide, a Path A local-run README (laptop, on-prem server, or Azure VM with managed identity), a Path B Dockerfile and ACA Job deploy helper (with the mandatory Azure Files mount for the bootstrap-log volume), a shared scope-grant script, and a compatibility matrix.

Switch Surface Simplification

Alongside the new features above, v1.11.2 includes a focused streamlining pass that retires several optional features whose real-world adoption was narrow but whose code paths added a disproportionate amount of script complexity, test surface, and documentation overhead. Sharpening PAX around the workflows the majority of customers actually run leaves a smaller, more readable codebase and frees subsequent versions to land core improvements faster. Retired feature areas include the DSPM-for-AI activity-set helper, the in-script schema-explosion modes, native Excel workbook output, offline replay mode, the Microsoft Agent 365 catalog enrichment, and the separate remote-destination switches (now folded into a single tier-inferring -OutputPath). See [Switch Surface Simplification (v1.11.2)](#switch-surface-simplification-v1112) for the per-feature replacement path and rationale. The legacy C:\Temp\ default on -OutputPath is also removed — -OutputPath is required for normal runs and may be omitted only when -OnlyUserInfo is used (in which case -OutputPathUserInfo carries the EntraUsers destination).

v1.11.1

Version 1.11.1 is a large functional release. It introduces three flagship capabilities — the `-Rollup` / `-RollupPlusRaw` post-processor, Microsoft Agent 365 catalog enrichment, and **remote output...