microsoft/PAX graph-v1.0.1

Graph Audit Log Processor v1.0.1

Repository: microsoft/PAX

Tag: graph-v1.0.1

Published: 2025-10-30T16:49:48Z

Prerelease: no

Release notes:

PAX Graph Audit Log Processor - Release Note v1.0.1

Overview

PAX Graph Audit Log Processor v1.0.1 is a major feature release that expands the capabilities of the Microsoft Graph-based usage data collection tool. Building on v0.1.2's foundation, this release introduces Excel workbook export, MAC (Microsoft Admin Center) licensing endpoints, granular endpoint selection, and substantial usability enhancements—transforming the tool from a basic CSV exporter into a comprehensive M365 analytics platform.

Key Improvements in v1.0.1

This release delivers 5 major feature categories focused on usability, data breadth, and output flexibility:

1. Excel Workbook Export with Append Mode

• New -ExportWorkbook switch creates multi-sheet Excel workbooks with formatted tables and auto-fit columns
• -AppendWorkbook mode adds new data to existing workbooks without overwriting previous sheets
• Automatic ImportExcel module installation and validation
• Workbook conflict detection with -Force override
• Ideal for recurring exports, trend analysis, and executive dashboards

2. MAC Licensing Endpoints (2 New Endpoints)

• MACCopilotLicensing: Per-user Copilot license assignments with three-tier SKU detection
• MACLicenseSummary: Tenant-wide license capacity summary with enabled/consumed/available counts
• Comprehensive service plan expansion showing granular license components
• Purpose-built for license optimization, compliance audits, and usage-to-license correlation

3. Granular Endpoint Selection (10 New Parameters)

• Individual switches for each major endpoint category
• Exclusion controls for fine-tuned data collection
• -IncludeCustomEndpoints for advanced scenarios
• Replaces -IncludeCurated all-or-nothing approach with precise control

4. Enhanced Data Processing

• Improved obfuscation detection with SHA-256 hash pattern recognition
• Better array flattening for multi-value license and service plan fields
• Expanded Entra user attribute collection (35+ properties)
• Optimized CSV parsing with UTF-8 BOM handling and comma-in-field robustness

5. Usability & Reliability Improvements

• Automatic Graph API disconnection on script exit
• Better parameter validation with detailed error messages
• Enhanced logging with endpoint-by-endpoint progress tracking
• Script size optimization: 1785 → 3182 lines (78% increase due to new features)

Why This Release Matters

v1.0.1 transforms the Graph Audit Log Processor from a data collection tool into an analytics platform. Key business impacts:

• Excel Integration: Eliminates CSV → Excel manual conversion; workbooks are dashboard-ready with formatted tables
• Append Workflow: Supports recurring exports (weekly, monthly) with historical trend tracking in single workbooks
• License Optimization: MAC licensing endpoints enable cost analysis by correlating active users with assigned licenses
• Selective Data Collection: Granular switches reduce API calls, improve performance, and enable scenario-specific exports
• Automation-Ready: Append mode + certificate auth + ImportExcel auto-install = fully hands-off recurring pipelines

Organizations can now:

✅ Build executive dashboards with multi-period trend analysis ✅ Perform license audits with MACCopilotLicensing + MACLicenseSummary correlation ✅ Optimize API performance by querying only required endpoints (vs. all 17) ✅ Eliminate manual Excel formatting (workbooks have formatted tables, auto-fit columns, sheet names)

---

Detailed Changes in v1.0.1

🎯 New Features

1. Excel Workbook Export

Parameters:

• -ExportWorkbook: Creates Excel workbook with each endpoint as a separate sheet
• -AppendWorkbook: Adds data to existing workbook without overwriting existing sheets
• -Force: Overrides workbook conflict warnings (use with -ExportWorkbook)

Example:

# Initial export
.\PAX_Graph_Audit_Log_Processor_v1.0.1.ps1 -Period D7 -OutputPath "C:\Reports" -OutputFileName "M365_Usage.xlsx" -Auth DeviceCode -IncludeCopilotUsage -ExportWorkbook

# Next week: Append new data
.\PAX_Graph_Audit_Log_Processor_v1.0.1.ps1 -Period D7 -OutputPath "C:\Reports" -OutputFileName "M365_Usage.xlsx" -Auth DeviceCode -IncludeCopilotUsage -AppendWorkbook

---

2. MAC Licensing Endpoints

MACCopilotLicensing: Per-user Copilot license assignments with three-tier SKU detection (Standard, Pro, Developer/Testing)

MACLicenseSummary: Tenant-wide license capacity summary across all SKUs

Example:

.\PAX_Graph_Audit_Log_Processor_v1.0.1.ps1 -Period D30 -OutputPath "C:\Reports" -Auth DeviceCode -IncludeCopilotUsage -IncludeMACCopilotLicensing -IncludeMACLicenseSummary -ExportWorkbook

---

3. Granular Endpoint Selection

New Parameters:

• -IncludeCopilotUsage: Explicitly include Copilot usage endpoint
• -IncludeM365AppUserDetail: Include M365 Apps user detail (default endpoint)
• -IncludeOutlookActivity: Include Email Activity + Email App Usage
• -IncludeTeamsActivity: Include Teams User Activity
• -IncludeSharePointActivity: Include SharePoint Activity + SharePoint Site Usage
• -IncludeOneDriveActivity: Include OneDrive Activity + OneDrive Usage
• -IncludeMACCopilotLicensing: Include per-user Copilot license assignments
• -IncludeMACLicenseSummary: Include tenant-wide license capacity summary

Example:

# Copilot-focused export
.\PAX_Graph_Audit_Log_Processor_v1.0.1.ps1 -Period D30 -OutputPath "C:\Reports" -Auth DeviceCode -IncludeCopilotUsage -IncludeMACCopilotLicensing -IncludeMACLicenseSummary -ExportWorkbook

# Collaboration workloads only
.\PAX_Graph_Audit_Log_Processor_v1.0.1.ps1 -Period D7 -OutputPath "C:\Reports" -Auth DeviceCode -IncludeTeamsActivity -IncludeSharePointActivity -IncludeOneDriveActivity -ExportWorkbook

---

🔧 Enhancements

1. Automatic Graph Disconnection: Script automatically disconnects from Microsoft Graph on exit 2. Improved Obfuscation Detection: SHA-256 hash pattern recognition 3. Enhanced Logging: Endpoint-by-endpoint progress tracking with record counts 4. Parameter Validation: Workbook conflict detection prevents accidental overwrites 5. ImportExcel Module Management: Auto-install with CurrentUser...