microsoft/PAX purview-v1.10.9

purview-v1.10.9

Repository: microsoft/PAX

Tag: purview-v1.10.9

Published: 2026-04-25T14:08:43Z

Prerelease: no

Release notes:

Release Notes: v1.10.x

Release Information

• Version: 1.10.x
• Release Date: 2026-04-25
• Released By: Microsoft Copilot Growth ROI Advisory Team (copilot-roi-advisory-team-gh@microsoft.com)

---

Script Download & Support

Download the script below. For questions or issues, refer to the documentation.

• PAX Purview Audit Log Processor Script v1.10.9: PAX_Purview_Audit_Log_Processor_v1.10.9.ps1
• Documentation v1.10.x (Markdown): PAX_Purview_Audit_Log_Processor_Documentation_v1.10.x.md

---

Overview

> ⚠️ Required Action for v1.10.9 (Microsoft Graph Permissions Enforcement — April 2026): Microsoft introduced a new dedicated permission level for the Microsoft Graph audit query API (/security/auditLog/queries) and began enforcing it across all tenants in April, 2026. Going forward, the audit query endpoint requires the new AuditLogsQuery.Read.All permission (and the granular AuditLogsQuery-*.Read.All workload scopes for optional M365 usage per-service queries); the broader AuditLog.Read.All permission is no longer sufficient on its own. All app registrations and admin-consented delegated scopes used with PAX must be updated to grant `AuditLogsQuery.Read.All` before running v1.10.9 against the Graph API path. Without it, Microsoft's enforcement causes the endpoint to return 0 records for CopilotInteraction and other workload-agnostic record types. v1.10.9 aligns PAX with Microsoft's new permission model and also adopts least-privilege conditional scopes — see the Microsoft Graph API Permissions Enforcement & Least-Privilege Hardening (v1.10.9) section below for full details. EOM mode (-UseEOM) is unaffected.

Version 1.10.x introduces two major capabilities: the Microsoft 365 Usage Bundle and Checkpoint & Resume for long-running exports.

The Microsoft 365 Usage Bundle (-IncludeM365Usage) is a single-switch activation that captures productivity activity across Outlook, Teams, SharePoint, OneDrive, Word, Excel, PowerPoint, OneNote, Forms, Stream, Planner, and PowerApps alongside Copilot data. This enables organizations to correlate Copilot adoption with broader Microsoft 365 usage patterns for ROI analysis and productivity benchmarking.

Checkpoint & Resume (-Resume) enables recovery from interrupted exports—a critical capability for multi-hour queries spanning large date ranges. PAX automatically saves progress after each partition completes, allowing seamless resumption after token expiry, network interruptions, or system restarts. Combined with intelligent token refresh (silent refresh attempts before prompting, proactive refresh for AppRegistration), this ensures reliable completion of even the longest exports.

Additional enhancements include memory management (-MaxMemoryMB) to prevent out-of-memory crashes on large exports by streaming records through JSONL files instead of accumulating them in memory, parallel explosion processing (-ExplosionThreads) for faster post-retrieval performance on PS7+, automatic 1M record limit detection for Graph API queries (with BlockHours auto-subdivision), new CopilotInteraction control switches, an execution telemetry export option, improved automation support with the -Force parameter, and UX safeguards when many output files or tabs are expected.

---

What's New

Microsoft Graph API Permissions Enforcement & Least-Privilege Hardening (v1.10.9)

| Area | Details | | --- | --- | | What changed | Microsoft introduced a new dedicated permission level for the Microsoft Graph audit query API (/security/auditLog/queries) and began enforcing it across all tenants in April, 2026. The audit query endpoint now requires its own AuditLogsQuery.Read.All (umbrella) permission — plus the granular AuditLogsQuery-*.Read.All per-workload scopes for service-scoped queries — instead of the broader AuditLog.Read.All permission previously used by all tooling that called this endpoint. | | Tenant impact | Calls to the audit query endpoint authenticated with only the legacy AuditLog.Read.All permission still receive a succeeded query status under Microsoft's enforcement, but the endpoint returns zero records for record types not covered by a granular AuditLogsQuery-*.Read.All workload scope (most notably CopilotInteraction). This is a Microsoft platform-level change and applies to every tenant; it is not specific to PAX. | | New permission to grant | AuditLogsQuery-*.Read.All is the new umbrella permission set that authorizes the caller to retrieve all CopilotInteraction and M365 usage record types via the audit query endpoint. PAX v1.10.9 has been validated against an isolated app registration holding only this permission and successfully retrieves all expected record types under Microsoft's new enforcement. | | Customer action required | Update existing PAX app registrations and admin-consented delegated scopes to add the AuditLogsQuery-*.Read.All permission family (Microsoft Graph, Application permission) and grant admin consent. After consent, no further changes are needed — the script will request the updated scope set automatically on next run. | | Interim workaround | Runs can use -UseEOM to bypass the Graph API path while consent is in flight. EOM mode uses Exchange Online RBAC and is unaffected by Microsoft's Graph permission enforcement change. |

Least-Privilege Conditional Scope Request Set

| Scope | Conditional on | |---|---| | AuditLogsQuery.Read.All (umbrella) | -not $OnlyUserInfo | | AuditLogsQuery-Exchange.Read.All | -IncludeM365Usage | | AuditLogsQuery-OneDrive.Read.All | -IncludeM365Usage | | AuditLogsQuery-SharePoint.Read.All | -IncludeM365Usage | | User.Read.All | -IncludeUserInfo, -OnlyUserInfo, or -GroupNames | | Organization.Read.All | -IncludeUserInfo or -OnlyUserInfo | | GroupMember.Read.All | -GroupNames |

UX Updates

• Connection banner filtering: The "Successfully connected to Microsoft Graph" banner now displays only scopes present in...